{ "Event": { "published": true, "date": "2021-05-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-05-08", "timestamp": 1620518581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "5976fa8c-5721-4501-b31d-bea06d731214", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560f8783-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620475381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "975b76ab-917a-485d-8bde-73983328beaa", "comment": "Malware payload", "value": "e59d6699e819cb69bb753054c90506b8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "79b704d3-8f2d-4743-be68-bc804d0a4a0d", "comment": "Malware payload", "value": "015774e21a53281266dede77ea239cf9b1c86b141401ece7630828ccc0fe8303", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "5fd5545b-020b-440b-b54e-c579715963b9", "comment": "Malware payload", "value": "d1ffefc9c34748d1c3f6dfa474b5a32ca47ef7e9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "0aef78ed-62b3-4e6a-96b0-3132d025de51", "comment": "Malware payload", "value": "ed647e2bfee82b33226c04bcbb559c3ccff78b4a69e0ae0078f8185da2e586b45e876c5ddef1907428b45cb57ed055e6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "096c2cfd-ca83-4589-bb95-ca3e416b69e8", "value": "12C2D002916F9BA6C46E18B21C0E7F9A0D01823DF17921FBBF18547A5D71F603DB6B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "9735aaef-5f93-4b11-9234-f39fd8f22d15", "value": "768:9TMhgfwgYJLeDCBSq2dns2rcnbcuyD7Uryqg:VMhgfQJyDwSPYnouy8mqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475381, "uuid": "86bbfc7e-cf03-4538-970e-34be230b825d", "value": 26644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475381, "uuid": "ae30a0cf-9ef7-41ca-965c-966e3aa0f9ee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "3c821a24-6a1b-48ff-9ced-eff96ac2e19d", "value": "root", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864434c3-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478897, "uuid": "6b13bf9b-2b80-4079-9207-1cbb73861305", "comment": "Malware payload (Dridex)", "value": "fc3173bc8c18e974c4ae17dda55d4790", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478897, "uuid": "d8c72d7e-5021-43b6-b226-1ce0e60d0c67", "comment": "Malware payload (Dridex)", "value": "0162190ef3440741b1d9832a78b2b8423df60ca65d820bafcb81c8a21b9c0561", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478897, "uuid": "fe9d0fea-b6cd-4634-be8e-0e1d831dfc0b", "comment": "Malware payload (Dridex)", "value": "87fc257632a6e83a76c7b53ca084ae45e71b6ea8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478897, "uuid": "2c53508a-3751-4a83-9fae-cb46b407aa47", "comment": "Malware payload (Dridex)", "value": "5f63a7460a24f6b684ff064a875b848a12846c490578a11179ad50824cf6b1705709d80797d067fa4609ed4702b6711a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478897, "uuid": "3b0982c7-2c25-48e5-afdd-2f48ce05dae2", "value": "62F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478897, "uuid": "842eb6b5-7dd0-4f1b-be18-bc8d5ae4c0a2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478897, "uuid": "594721ff-9ceb-43cc-bd2b-8500a542d3a1", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478897, "uuid": "12f90f48-3421-405c-86e4-9d94d305ccf4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478897, "uuid": "289ceb0a-6a6a-4c91-a438-718abc59ad1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478897, "uuid": "f756a34f-80dc-473a-b116-6038a406812b", "value": "fc3173bc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a3d494-afa1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620439280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439280, "uuid": "5732bec3-bc15-4468-ab66-ee5def3d5aeb", "comment": "Malware payload (Dridex)", "value": "dbfed30e2bcd275997f213bd480e91da", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439280, "uuid": "90907f7f-1bb5-42bb-aeb2-062b74b9b798", "comment": "Malware payload (Dridex)", "value": "0163aeb4ac85246d490768bcd414c072c9d04f71fe9aff05ffc731831d7ac0b9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439280, "uuid": "0615fd40-29ff-46b2-963f-9c9e80948a2b", "comment": "Malware payload (Dridex)", "value": "e6d043fbf63aeb45f83145fbbbab4108ee1a83ec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439280, "uuid": "d2b3d4fa-343a-4db4-a8e2-29488fccb43e", "comment": "Malware payload (Dridex)", "value": "ebc83398f40d043a1f206109b45ca535fd1581c0fab67db1ea754e76abb95fc3ce46ee12434fe6213f86bdc2946d50d3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439280, "uuid": "5ceda742-52d7-406e-8b30-21f2507cb497", "value": "B0F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439280, "uuid": "38c697dd-ac62-486d-9152-ec285eb0178b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439280, "uuid": "e4a599d8-a781-4851-834f-c1968c5fef42", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620439280, "uuid": "c059137b-39a9-4b13-bdb8-f83dfa287f8a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620439280, "uuid": "6cc29547-ca35-4b7e-b74f-1038fd668e2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439280, "uuid": "1531a91e-1d9d-4530-831c-763465333949", "value": "dbfed30e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8934e2-afdc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464550, "uuid": "3fee5d9a-c010-495e-b634-3dadc25370c1", "comment": "Malware payload (Dridex)", "value": "229318f7c61f4aee00d98dbfecc19bb8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464550, "uuid": "a37459fd-82c3-49ad-885e-a6862029a866", "comment": "Malware payload (Dridex)", "value": "016fb386984183629db7bdcb897af35f589e1cd1b3d6c0d78d0d9ba7e91c4ada", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464550, "uuid": "c9677670-9550-4de4-89fc-63e56098ffdb", "comment": "Malware payload (Dridex)", "value": "0eedaf0a7692b8e0a2c54e90177e8070291aab5d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464550, "uuid": "67e6c2aa-f235-49cd-a8fd-6b3435d84bbe", "comment": "Malware payload (Dridex)", "value": "0316b4561ae512dfc635712446b16aa94086aeb171bbd528f6e106d0493b7a085cb09e43f1d96199bdc204922272a0eb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464550, "uuid": "17a76152-b46c-4cd4-b386-e72258849b70", "value": "B8F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464550, "uuid": "3cace40c-ee93-4c5d-b947-d4e9cd90b8f3", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464550, "uuid": "b6b34236-f391-4257-a862-d3e90b3725a4", "value": "3072:JiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:6eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464550, "uuid": "dd4fd8c4-d7c4-4b4d-8ac9-a7c9c1eb1f79", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464550, "uuid": "92447d27-a41b-4257-b6d7-67f1d0b6704a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464550, "uuid": "5a4754a4-c78b-4b46-afbc-3fad05e86f12", "value": "229318f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b9cf03-afdb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620464483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464483, "uuid": "380daff8-3a26-4e57-8c22-5439f353d8c4", "comment": "Malware payload", "value": "66f2bbcf02d100a9eaae4384f12ef71f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464483, "uuid": "945e4caf-a8b9-45a7-b95e-9eaf4cd9ad2a", "comment": "Malware payload", "value": "018821ec73cbc8d535ec9dd7ce2ca093fd26a3f84934ccb8f8a0a1de997d3ef6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464483, "uuid": "d656c8de-b854-4b5b-937a-b05e33525a3c", "comment": "Malware payload", "value": "c60aceccf99af98e9f475eafacf2d6037030e2bc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464483, "uuid": "48a8bf0b-8827-4f4b-9857-ecf390db1608", "comment": "Malware payload", "value": "59282831bad52a60af5ee500b774b27b23fbdb9b98570c8f20631ed3b8a372ec99f6689047d3eef32537f264f8984dbc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464483, "uuid": "6316d1d3-6f5e-4ed5-a8d6-82ca0a0d70a7", "value": "EAF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464483, "uuid": "2f1b55a7-cc44-46e3-9f30-1029bb1c2026", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464483, "uuid": "ef1da313-0b38-4beb-9feb-ae5bcab9aecb", "value": "3072:/iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:0eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464483, "uuid": "0f8b021a-3a28-4b04-b339-0003fce9127b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464483, "uuid": "726b6fe8-905a-4216-a4e8-ae1dc035679f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464483, "uuid": "dd58b3b4-77f7-4740-9933-4c93cd27a760", "value": "66f2bbcf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc3a48b-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478935, "uuid": "ed6ca6c7-c023-44ce-a76b-383e7ae3f3b5", "comment": "Malware payload (Dridex)", "value": "f7bcf876a10b3f1af7ca819e50a0061d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478935, "uuid": "1e87b2ea-b6bf-425d-956f-ac900defcb1d", "comment": "Malware payload (Dridex)", "value": "01c9d94afa4ef5fea23329a8bf0e14390ca8b40a9b16ca2c602522b8cdaed024", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478935, "uuid": "93c23e55-484c-4975-a63f-300f151635f5", "comment": "Malware payload (Dridex)", "value": "1636e3fbd8fad00f762e3f2dca27f99e21763791", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478935, "uuid": "272feedc-b261-47af-b3d8-013a4094988f", "comment": "Malware payload (Dridex)", "value": "e85a6f3440c5deb5b69d7ebf11d231e173f440302ae655394bad20373218fce5aeff006b7f42586b5dc387e5f36519b0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478935, "uuid": "41f25e34-ed11-4524-8489-c298fc5b3918", "value": "31F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478935, "uuid": "c17b3625-e4ee-43df-822b-5a9a5a926976", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478935, "uuid": "650ac0c5-e1b6-438e-ade0-c9ba98999746", "value": "3072:2WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:242IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478935, "uuid": "65009c49-7743-4d13-81e4-4946d668faa9", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478935, "uuid": "4b704141-ace9-4bcb-8755-b8fbd3eabd51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478935, "uuid": "318f83e2-1108-49aa-ae0a-ee27660b22ff", "value": "f7bcf876_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d6d080-afb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446466, "uuid": "b4fc8b3d-a660-4848-a51d-8d1ccf592ba8", "comment": "Malware payload (Dridex)", "value": "5076e6c58e3f247f3601ed33d06c450e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446466, "uuid": "4c5bef00-e549-4e95-a383-085e3b6f399c", "comment": "Malware payload (Dridex)", "value": "0209662ba054422a700fc6b2f2b15e931fcc0e949c6e030f07f013e93888356f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446466, "uuid": "342105fe-ed97-4212-8426-9853f138e7d4", "comment": "Malware payload (Dridex)", "value": "bbac70d8846d53a1da2f502b05f815ad3834bccc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446466, "uuid": "8553cafb-23f4-42f7-8f6f-6a8969a084ce", "comment": "Malware payload (Dridex)", "value": "2d5dcf437254d20a6a03919fc2b9339fe6a3a43c713ef19b19980e7612ff1b1fafbaccaab13b29c45854dab5c09feeed", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446466, "uuid": "90fcad84-9011-4d42-a29e-dfd860f2a837", "value": "18F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446466, "uuid": "5b288fa1-677d-4735-bf13-90c3432e4e97", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446466, "uuid": "f0924150-2ce6-4d89-8804-62ebd6fa3675", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446466, "uuid": "b07d0cec-9c96-4c80-9474-021f4681dbe4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446466, "uuid": "da4d78ef-e966-4f78-a5ce-8b761822a834", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446466, "uuid": "5c66d69d-4553-4aad-90e1-1ecc7b5d3219", "value": "5076e6c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331d8032-afa1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620439244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439244, "uuid": "f98cdfe7-6d09-47b8-b565-2c6af4cae608", "comment": "Malware payload (Dridex)", "value": "8484bb101c20b527331f4ee74e74692f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439244, "uuid": "550ae0d5-ce53-45fa-ba85-ab8e1f84a70f", "comment": "Malware payload (Dridex)", "value": "035accf7e3319df10fdb14cee23c0bc63f81bc14863cf1266f34477660bd4733", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439244, "uuid": "cd917899-7c6f-4b90-ae7d-aa0a69d0cbb5", "comment": "Malware payload (Dridex)", "value": "73d41158c20c2eaac1aac8a4e485c90c067b0bba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439244, "uuid": "b2e58d3f-2961-4087-a3e9-72d5fdb8b87e", "comment": "Malware payload (Dridex)", "value": "3b7fee5733749f36988f2906eca280bb6ec6c598a171c37869b0e882b53fb3ec3cdc2559d130de93bd7f62a2e878099d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439244, "uuid": "afe87cb0-31ee-4e9f-ad42-5c1021dcc11e", "value": "DFF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439244, "uuid": "b64b3cc9-c2b1-447b-9528-a0af34443673", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439244, "uuid": "8f12c469-b0cf-44c4-b4ee-e6083d0fb860", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620439244, "uuid": "367f81b1-2be6-4d1a-8325-56e527362ad8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620439244, "uuid": "5007ba11-63b7-4334-91d3-0287b298b0c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439244, "uuid": "2999ed9a-790b-4314-8f9e-8d6dc6066ec9", "value": "8484bb10_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396e3069-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486070, "uuid": "c16955cc-80d5-479d-b99e-50fa46759073", "comment": "Malware payload (Dridex)", "value": "ff60e01f192dcd34b31e0153105bb92d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486070, "uuid": "1a70879d-9610-4aae-9294-831421966151", "comment": "Malware payload (Dridex)", "value": "03d11097a63797228376ac746f933c06dc3c7ccbe4f6c773a27806316534e968", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486070, "uuid": "b39bcd1d-0ae9-48ef-b71c-ce390662dbc6", "comment": "Malware payload (Dridex)", "value": "06b05fbff9e71438c650dd888feace12a8aeefab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486070, "uuid": "5e2cf8f8-6154-4f39-a713-04950f9be65d", "comment": "Malware payload (Dridex)", "value": "10d9e5988e966c143f6e11c6ece79cc6ccdb5310a73d80569d7c28aad1cad7c9f021c39f576c6221f11bfbae1b853a9d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486070, "uuid": "a375cf67-3f3b-424e-83a9-d20b70347dfd", "value": "41F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486070, "uuid": "d91e9c8b-13f0-4e97-a776-ba8836e566f0", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486070, "uuid": "0426af57-268b-49fe-8443-48efaf411b63", "value": "3072:eWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:e42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486070, "uuid": "5019f3dc-272e-4933-94ba-0cab003142d5", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486070, "uuid": "d06050f7-e6b1-4947-8b73-bca3696a34ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486070, "uuid": "9715a5b6-e403-4a7f-9de3-86f3b32ed335", "value": "ff60e01f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681cd1e9-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432032, "uuid": "6494ef36-0630-4e48-b863-3c66bfa0f5e1", "comment": "Malware payload (Dridex)", "value": "dd98976886fd1cc8dd8a061ebeba0013", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432032, "uuid": "19f91819-7988-48e8-9882-9393ceefed8e", "comment": "Malware payload (Dridex)", "value": "045d5a931fecb81b80f9563a438bed3323674a96ac99cc6d9c8ec10292769ba9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432032, "uuid": "82e91cf2-cd38-4336-b6a8-7ae542e269ac", "comment": "Malware payload (Dridex)", "value": "a1020aa7c9d0e6dce544e0d765bb5b728c52a745", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432032, "uuid": "25bdc806-b909-4cc0-9ed1-83131eb76015", "comment": "Malware payload (Dridex)", "value": "8aa85023814040ba6c29de30ef2d3d3e7b0b5aec7e1163c84cd7d2b29973e373b672b943d3e6602414c2c2c363439676", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432032, "uuid": "3018aa32-1dde-43fa-b216-2c21d5fcc856", "value": "56F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432032, "uuid": "7e037a24-a4eb-4435-94e8-178b6f64763e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432032, "uuid": "6b9de59d-ecb9-4245-8c64-a4231d3a4225", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432032, "uuid": "a4d55e72-8c29-423e-82f8-8aed462f2480", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432032, "uuid": "7c319870-eadf-45d7-bb57-7a54ac4a83e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432032, "uuid": "024d19fb-826f-4a41-8ee7-04265a1f5f42", "value": "dd989768_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5b3147-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478938, "uuid": "53eb705f-c6b1-4258-89a3-6502b1d6bf2d", "comment": "Malware payload (Dridex)", "value": "95127c0a9cc3b1893dc41e1e394fb2b3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478938, "uuid": "f1628135-3d25-47a5-94f4-878fd8d260bc", "comment": "Malware payload (Dridex)", "value": "04eded5a9c04ba5d8cddeb37c57389a62f6b0562e355e833d256fe277862306d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478938, "uuid": "41106222-5e7d-418e-b040-dea82d89e71f", "comment": "Malware payload (Dridex)", "value": "63e0bd4017ed6ada206110fc6aba1da518e0158c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478938, "uuid": "f2f5c073-1b14-42e6-9fb1-3ebd839462ed", "comment": "Malware payload (Dridex)", "value": "7d0a5f8824c72a62dfeaf5fe0d2c57c24b9d4d56bd6418b77c00f15cb0ee4808d2016132571acd8ce447b8a07f8f7d7f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478938, "uuid": "ce396e76-7c5a-4a2c-9efe-959fa4dd1ef1", "value": "C5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478938, "uuid": "3d36ae45-643d-43b3-8ce8-afcade5ebd70", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478938, "uuid": "7b2d3e77-9174-402c-9c6b-4a507597bd41", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478938, "uuid": "1794eeda-feb4-49b9-9e9d-651a8ffe5e88", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478938, "uuid": "3ca39b13-d6a2-4c98-a46d-95af69051462", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478938, "uuid": "2a74b4cb-c6c5-45a7-90cf-2d876be13645", "value": "95127c0a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7d1152-afdb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464441, "uuid": "910b5f68-124a-474c-b0f1-b013232c2072", "comment": "Malware payload (Dridex)", "value": "453f59d9acbd2fe31af73767aae2f6a6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464441, "uuid": "5ef8642d-f051-4c47-a87f-bb1106dc47d7", "comment": "Malware payload (Dridex)", "value": "05501a9ca0bda9f8560de4d957ca7a78b505226596c5ec98f98cfb03eafb144a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464441, "uuid": "bfe4e0f9-2cbf-4270-ba6a-ddc30ae3b218", "comment": "Malware payload (Dridex)", "value": "2ea260128c23ee51fbced65d03b8fa60c6230970", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464441, "uuid": "cbbb1016-6d6d-4659-a8d3-c5f0c50132ab", "comment": "Malware payload (Dridex)", "value": "bb68cb24297e283dcb0d46b48e4ed8ae24b23aa01aad9dfb2cda5f169ba765c7fcf4e32d9c50ff31e7a84c7eae06c0b0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464441, "uuid": "f9736eaa-138a-4181-b1be-3611a01714b4", "value": "17F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464441, "uuid": "46390ca9-be80-4f2f-9d3e-31339b112490", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464441, "uuid": "6d1af8a1-736c-4318-9130-cd4400b8bf13", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464441, "uuid": "0455337c-db12-4f10-ada9-b403dfd55890", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464441, "uuid": "f6e94cc5-731e-493d-8785-df88a0210255", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464441, "uuid": "ef9d7d78-4ac1-40b5-946b-ab5007f14437", "value": "453f59d9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b6dbc2-afdc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464530, "uuid": "c4bff45e-65e3-411f-ac74-5d234eddae3c", "comment": "Malware payload (Dridex)", "value": "124f59e39db799c32b2a2499ada26603", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464530, "uuid": "33bc5d56-3437-4e1a-a022-9365a7073ad2", "comment": "Malware payload (Dridex)", "value": "05b5f225c9d4e2c571f275a318b79b9d56897e17d7f6602e5d3bbcbd66fe07ff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464530, "uuid": "d8d6c2a5-8ce5-42a5-b50b-b976a3ecf331", "comment": "Malware payload (Dridex)", "value": "aa8159bdfd25e4b19a15f09b0c53bf6fad23af7c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464530, "uuid": "29646ceb-a4fd-4be2-9163-6ddfd4e91b66", "comment": "Malware payload (Dridex)", "value": "a0c7bdef1e1534ee7722610166c3bf38f8d11b587f32106e7110486d6d35c68ab15f5b0666d7d9e48adff1bc6f0e33cb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464530, "uuid": "ed6528d2-fff4-42f2-ae89-7fa6011d8f95", "value": "28F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464530, "uuid": "1a4aadd3-ee43-4d0d-8c7c-7c42a72d86f1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464530, "uuid": "09df0961-662d-4a8e-b82f-8150ab073ec6", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464530, "uuid": "37d28e1a-b25a-4616-8762-f28f0b599177", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464530, "uuid": "956864f5-6a95-4d5a-b428-5c893072fed4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464530, "uuid": "d3fb6d69-ab7f-4037-9f90-7c9bc4e70a09", "value": "124f59e3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996a77eb-b051-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620515007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515007, "uuid": "12fb67b1-dc73-458d-a245-0a9538c83a9b", "comment": "Malware payload", "value": "f4c23ff4c0b8faa0f5a7f3d077f24632", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515007, "uuid": "0b3de5cd-cee2-4dff-a838-bdd1477a9d20", "comment": "Malware payload", "value": "067b175bf3183dd1e6e295d72f29e168b89fe6494d157ed409792d851f90c222", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515007, "uuid": "94aed8f2-beb8-42dc-b53c-1442f66b613f", "comment": "Malware payload", "value": "6cadb1f2d107b3f2a14948afa8b909f713e94c91", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515007, "uuid": "96b5506b-ee26-42b4-9b07-ffd4bbea0893", "comment": "Malware payload", "value": "e0954c044b85f0a591612d5bd827911714679918d544b5055078f9e3c9e7b051f0b2dc31f674b00b6cb553ee86ce3dc2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515007, "uuid": "d7b2342b-860a-43cb-a8df-45ab1bcb7c30", "value": "2CF3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515007, "uuid": "9152b503-44bb-4af9-bad8-96cc94e7ac9f", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515007, "uuid": "01571295-af73-43ad-9cf1-14a052af8921", "value": "3072:he45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:A4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620515007, "uuid": "717d3d8d-a882-4504-a079-f3a086f955af", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620515007, "uuid": "c47ca680-98fb-4ab2-b623-6adc46a8dbff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515007, "uuid": "0ecf6621-1d19-4f0b-a027-2552ed166241", "value": "f4c23ff4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9318f759-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620442841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442841, "uuid": "2ddc671f-477c-4b72-a307-6933ea5c4e3d", "comment": "Malware payload (Stop)", "value": "67145aa4e7b166facaff4caa7d5c6528", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442841, "uuid": "22b4c9f1-d5a9-4404-99a7-3ee7c6ec25b3", "comment": "Malware payload (Stop)", "value": "06db31be7914d281c35acd803c526fc82e474aa2dc340806b76ee4ab0be240bd", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442841, "uuid": "ea2a54a7-f7a4-437c-8ffc-1976f31cbc4e", "comment": "Malware payload (Stop)", "value": "92ccb6e91816b847d346909cccd9cfc9c116e490", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442841, "uuid": "74853202-fbe4-4c5b-827b-585d8fe4e717", "comment": "Malware payload (Stop)", "value": "629a682fab6b63d8f9b9445632ab656f81646e82dc9b2ba6de6f48b9e566fe5667b3d795da800c5d14553549e7d54763", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442841, "uuid": "3449300d-bce9-466b-93a6-0b1013ef304c", "value": "5615011175809032DD291D3A4461CBA85EABB833AF668F8F96DD1B79DF207D1B72430D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442841, "uuid": "05b86f4a-4d19-4d24-923b-eb19b9d28d01", "value": "e5eddde3bc28318303bde004dece8436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442841, "uuid": "653e0779-6c60-4830-8404-86c881fa266d", "value": "12288:dLDhzAEBtc5txSDxizjF3PFEORUcwoxCtEfHHond+CalI/98OX0jeEVJLmUx:dLdsXQsfF9Eqw+lHonkCaqCOX0je/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442841, "uuid": "0732226a-ceb9-4e9f-8cac-4ca79a34f64a", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442841, "uuid": "198b0ae1-0c6e-4d12-acaa-09752456d7ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442841, "uuid": "de5a8bf6-880c-4bae-b1c0-772e4e8a1d4e", "value": "67145aa4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698496db-b041-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620508055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620508055, "uuid": "552ff731-db5f-4545-ad3e-93d5060a4783", "comment": "Malware payload", "value": "d802aa9938e87dc33cf2c7a07e920b0b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "old", "colour": "#D686E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620508055, "uuid": "2fda7b9e-c2ce-47a6-b502-abaf960c56dc", "comment": "Malware payload", "value": "07154b7a45937f2f5a2cda5b701504b179d0304fc653edb2d0672f54796c35f7", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "old", "colour": "#D686E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620508055, "uuid": "cd7ed077-0380-4b92-a3b7-61e50a7de7a2", "comment": "Malware payload", "value": "0c16ba49cf87b42ff85dc87a045950fdefbffcae", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "old", "colour": "#D686E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620508055, "uuid": "058f2329-a6c0-41a7-8fc0-b35ce7296ac7", "comment": "Malware payload", "value": "183b6c8d8372a6921910e11831757610192bde22d026a9a6be6fc6855fd3aeb61af1b2cb89985a03a3032d030adb2168", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "old", "colour": "#D686E7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620508055, "uuid": "a6300689-f20f-4729-8378-689e60e32828", "value": "BE931843A34092DCE4168536AEDFAB216B11FC940DA96B4753B6F2282FFD5E92F41313", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620508055, "uuid": "6649018a-9d7e-4a23-865e-84856a3edf31", "value": "1536:08P9vuN56hQg/M8vNbCAsyocYmxQ39Abo1SzzDy1zZTfJOB:0UKkM8VbDoTmxQ39t1SzydZLQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620508055, "uuid": "c85930fa-d2b7-4bec-9eb1-b970a94fc5f4", "value": 96708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620508055, "uuid": "cdc83bfb-45ef-44e3-a4c7-ea6fa78ede49", "value": "application/x-mach-binary", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620508055, "uuid": "dd54c9df-7f57-4be8-a58a-5ce0b8370124", "value": "07154b7a45937f2f5a2cda5b701504b179d0304fc653edb2d0672f54796c35f7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f510715f-afb1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446442, "uuid": "85e03968-8c97-4fb6-b30f-9174aace7b60", "comment": "Malware payload (Dridex)", "value": "ecfab49de81f843675e4532113419642", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446442, "uuid": "bcb4336c-7014-45c6-9378-334c426c8c12", "comment": "Malware payload (Dridex)", "value": "079e2718ed14db23b2defa993cec7fa4332b1e0fd8fc0994949e0d9b0c7ca413", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446442, "uuid": "5ecc6bc0-724c-4b80-9eb0-c70ea65b1d15", "comment": "Malware payload (Dridex)", "value": "9c8a6159041ad45e40e3e3825a71f113f76fbf8c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446442, "uuid": "885f622b-5693-42f5-880a-cdead7411742", "comment": "Malware payload (Dridex)", "value": "d22a23c2cb2bc0bfa16620bf08bed021570d7efc1ef6b1607ccf0acc16ff88883017e8af6845ea4ae78827c80d075302", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446442, "uuid": "7a6b826e-d1b6-417a-8a71-df18a5daf4ef", "value": "C5F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446442, "uuid": "4b6c163c-eda6-4a37-bc60-cdeef987d5db", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446442, "uuid": "41eab8d6-9821-422c-94aa-c3ce1b449bdf", "value": "3072:KWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:K42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446442, "uuid": "691d03dc-e98a-4c91-bca8-2444fc719f17", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446442, "uuid": "4cdda8e2-5579-4a56-b024-de245b26ce08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446442, "uuid": "0bcf67c1-4bb2-4a41-88e1-2090ffa4b350", "value": "ecfab49d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4756654a-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486093, "uuid": "116f4857-131f-40a5-ba16-77d799ad5615", "comment": "Malware payload (Dridex)", "value": "f88dcae307aec34dd1e099dd7781aced", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486093, "uuid": "8f7738c9-d82b-4bb2-95ef-dd7969472db5", "comment": "Malware payload (Dridex)", "value": "07c7823d267c2d770722c0eb3defab79e007b296ec27c329050aaeb1d0d059d4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486093, "uuid": "ddbde319-fcaa-4946-947f-d1b2267a4e67", "comment": "Malware payload (Dridex)", "value": "69d0e019522db980c367d7df8664b509296c34c3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486093, "uuid": "9b286865-099b-4846-b1f9-d353feb711f5", "comment": "Malware payload (Dridex)", "value": "df6d3ac5515bf004839a77726f8249577205c79d7a51085c9d968573f21184c9b816b4f2ef6c47a3d45671951b96978e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486093, "uuid": "590290c7-337b-4e95-b4b5-a563c52540a4", "value": "A9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486093, "uuid": "83999647-6bf4-4634-bec1-1cbc8bea39f4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486093, "uuid": "6a21447d-bdb7-4120-8946-9e256b22f01e", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486093, "uuid": "094f6cf5-c429-4655-80a9-e1fa13d11370", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486093, "uuid": "a8d11c10-599b-4bca-a601-ad0438a85190", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486093, "uuid": "7b5d13ab-7427-4517-ad86-16e3c4d015c2", "value": "f88dcae3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f95826f-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468041, "uuid": "98ebe9f4-d760-4915-b365-d0e780ef98fd", "comment": "Malware payload (Dridex)", "value": "745080c793bd99b54d9143470f8470aa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468041, "uuid": "446d1150-4da9-4003-8748-90594208e093", "comment": "Malware payload (Dridex)", "value": "07e3b302cb88fc6833f0adba669719874908e8ea9b82723c92536c7ea4ed9fdf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468041, "uuid": "c01a4ee4-cca6-41ec-a492-bae517521d43", "comment": "Malware payload (Dridex)", "value": "b6d576c47befbf4ab49daba7aae26959caf1061e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468041, "uuid": "af93eb65-7e5d-4cde-9a6f-4c244f648502", "comment": "Malware payload (Dridex)", "value": "0aa972c8bab1874b507022c22fbde0a10dd22d3bdb89933a62658920bb4527066f54b9ef31189ea33de68ed43524b16d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468041, "uuid": "da1e62c9-483f-48a6-90e0-8d5915992142", "value": "88F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468041, "uuid": "05f32a65-819b-41b5-9846-a74bec300e57", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468041, "uuid": "a3b6c00b-0e21-44ed-a845-c8942c24b5ea", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468041, "uuid": "b143381e-96f2-4615-8dd9-e70886e16e50", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468041, "uuid": "54ab262a-3666-4913-bd2c-51212584d032", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468041, "uuid": "fe931191-0359-42ac-a53b-afd707b1570f", "value": "745080c7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc98fc9-b005-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482531, "uuid": "c29d7d22-5120-4e30-8f53-8054388e6677", "comment": "Malware payload (Dridex)", "value": "e386f6a2bd703caac3e9add6229a7c1b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482531, "uuid": "8e5e43f5-5ed3-45b0-adfc-ce595f5265ca", "comment": "Malware payload (Dridex)", "value": "07f035efa4245758a9bd1754e5e803563c7d08c8bb3d3bc401c556c1bf47efa7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482531, "uuid": "b5072c93-a21e-425c-bf03-f53c7cf001a1", "comment": "Malware payload (Dridex)", "value": "328b3ffc9405b40179cc4164ae6426fca01a687c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482531, "uuid": "75c718d0-1c7f-4707-a605-5308ee18f5e5", "comment": "Malware payload (Dridex)", "value": "c4e55faad2fde699bf77b6a41c9ce1fe01e69772a00079b29bb92998f4af136e1a36bdab1f02b23a04cdfb3a587ff093", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482531, "uuid": "49165284-f232-4e19-8f47-10f3680d543c", "value": "D2F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482531, "uuid": "3d17f870-dfea-46bf-8d21-6fe9b9ad57c9", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482531, "uuid": "27bb0d73-2a6f-4c55-93d8-87697f7337a6", "value": "3072:KA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:K3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482531, "uuid": "130c7656-e814-4765-b49f-32a227c1f685", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482531, "uuid": "e6f1052a-3979-47aa-a7db-49055e1b6834", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482531, "uuid": "7f7b4e3d-9faa-4a6c-8753-23d8808f05c7", "value": "e386f6a2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bfdd3f4-b027-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620496946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496946, "uuid": "acf518d4-a14d-4098-9174-16ef6d733989", "comment": "Malware payload", "value": "ee2cc7489cf90c792e136b6017fcf493", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496946, "uuid": "ed77380f-f12a-40e5-9c06-1b78624829ba", "comment": "Malware payload", "value": "083b2f418d01e30ea145ba1cc9b7c33261c4f52656b5533dca2d6736f02e7178", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496946, "uuid": "afdf9cec-7132-4b15-8300-8aa885c82ade", "comment": "Malware payload", "value": "febf9f6b7e89dea30e61f8e44ddf9c6e0bee0789", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496946, "uuid": "6d01d5b1-f590-4acf-804c-6c96fe73dbe0", "comment": "Malware payload", "value": "3a66b4a961a9d1988b7a8434b640dd7afa52499d3b5055f92434cfaf5b5b1498d251abea51ce49e42c080301b0d34101", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496946, "uuid": "03d2370c-0df3-4ebd-9c2b-ae8747c5c61f", "value": "2924126DC8E6EA1BCFA7283A82D55F632567A06291F37C0CF618F63CFA48D0294514C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496946, "uuid": "c19c628f-f408-44d7-bf7d-eb56d611c16d", "value": "6144:B7hVYFkp7AaIO+/ENhLv5xyGBVeJZnC469axilrxDc:BFSEAan+crRBjeJZ369KYrxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620496946, "uuid": "357cc88e-534f-4f31-81b9-4673ff528063", "value": 225481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620496946, "uuid": "2b1857da-ec06-4394-a045-21a5ba6e7dd9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496946, "uuid": "7e617613-c3a8-406c-8264-c03fd4dff3ef", "value": "scan of purchase order 8354494.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2326004-afd7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620462704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462704, "uuid": "44f4fbf1-e224-417b-a7df-6dc138101cb3", "comment": "Malware payload (Gozi)", "value": "a40e7e271f1c83721f2ead8c1c347cdb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462704, "uuid": "f4e051c2-f91b-403e-8008-1ef8e8d0488f", "comment": "Malware payload (Gozi)", "value": "08fd06ce8e7fb421dfb25e5aa521667b978f7b17a49472ee8f3ead207017986b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462704, "uuid": "885eaa05-d748-4a7d-b178-fca6e4e24616", "comment": "Malware payload (Gozi)", "value": "a32bd04b8bcf083f58694a2693e9aa99d676652a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462704, "uuid": "8b2ae0fc-2c78-4551-856b-a4fd1cd6dc76", "comment": "Malware payload (Gozi)", "value": "b707730746b3f0c044c9b7632d7e9e90dcb2657eb61a757f62700b82f37ae8ff039709c3e35c8239be8fe30584077aae", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462704, "uuid": "18504901-2e5b-4ac0-b0b5-570d9a7b303e", "value": "2615C03138C1C232D573A0780A69D6B04BADB4301D359B9F77DC2B7E6F715A092369AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462704, "uuid": "3a2ab771-f195-49fc-895e-79f1299857c8", "value": "7a79d10b1d4343a18a4f6e25e165b4ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462704, "uuid": "4f20fbd6-7c4f-4e3c-ac8b-4a85d8fce7e2", "value": "24576:HQfpzjXPgfM8CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDgAJV4OaIRj150CpNiLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620462704, "uuid": "669a7478-a90b-4853-b6c2-7544b929aded", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620462704, "uuid": "479cad50-e94e-4791-bff5-e8c6b60a1050", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462704, "uuid": "6fd2fe63-8956-4aae-bf2a-92b7226307a0", "value": "a40e7e271f1c83721f2ead8c1c347cdb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb2ecd8-afc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620456254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456254, "uuid": "d716b8f3-68af-4242-a964-e1487d3c8d7a", "comment": "Malware payload (AgentTesla)", "value": "29d5d4b4bf830fd8f63ea3c96eb7d33b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456254, "uuid": "964e55ba-ac9c-4644-a7aa-f133819261a4", "comment": "Malware payload (AgentTesla)", "value": "0967a7451bb94015f75d72c977d9116b7577e5d1ddad7824e6b2f80065d8d4e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456254, "uuid": "d5c65b34-b310-4a1f-a13b-47ae0b5f6bf2", "comment": "Malware payload (AgentTesla)", "value": "cc5b5102e915933926c85066ff0e258549a7531b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456254, "uuid": "888d8808-a133-4bde-866b-d59221de159d", "comment": "Malware payload (AgentTesla)", "value": "54b0974dc99acff455c7248e8c74793c5b1a9697967dcc03a8dc55d1b1a11749793812bd5137f6cbd7366dbd73bb0fde", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456254, "uuid": "01312059-71da-476a-a50b-6bde85b05fc1", "value": "BAC4022833D4AF59D93E273A4570620013B8FA129B93EB8E6FD050DE2D7B784855C7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456254, "uuid": "87f05e2d-2449-40d9-a687-26c8638ca11c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456254, "uuid": "a953e5a2-19ae-46bd-9c3c-e10fa37b46bb", "value": "12288:onZNMYX3Mgl79NTdjou353D2Cw0AlCBO4jb:AN0gl7/djooVaCwllCBO4jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456254, "uuid": "0047ce0e-67e6-4022-9c7a-793f6a069a69", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456254, "uuid": "b9b33318-8926-442e-a014-427677cd9352", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456254, "uuid": "85c6aa94-dc5f-4a86-96bb-6ec61fecb99c", "value": "LnUK7BSn4pKs4AT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8941d43-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489692, "uuid": "d11e6f66-c0f2-4c78-9004-d78fcff80b20", "comment": "Malware payload (Dridex)", "value": "5da36e8e6be6737aae21537cd25e0a24", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489692, "uuid": "faa5de87-fb38-49c9-aa99-0ff32347ed9e", "comment": "Malware payload (Dridex)", "value": "09b3592d775ccc1d4b9cf7d04d2598696ed0ace5b3b55befe59f766021a99091", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489692, "uuid": "29b11f26-0fde-44d9-8987-b3c93ae29151", "comment": "Malware payload (Dridex)", "value": "987b5e6a128f6a33484b8d375743127a72c28256", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489692, "uuid": "dd0da60d-9d99-498a-aad4-1227dda8d818", "comment": "Malware payload (Dridex)", "value": "c24548b5d3323eb5d0bd7ace179b103e87e81b7c9ee44b920832944fea247bc8d77e6e72abd0ce9e52799c3da195e717", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489692, "uuid": "e8151c25-284b-41f2-a4ad-6c7a7b9a547f", "value": "FBF3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489692, "uuid": "c83b1f02-4a13-4912-951a-3c3963664b7a", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489692, "uuid": "4074d40b-a248-4c56-b54e-0459668b3ab6", "value": "3072:puFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:p0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489692, "uuid": "892f3bc3-4808-42cf-912b-16cc4f4daa75", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489692, "uuid": "bd45a2e0-d27c-4d8b-ba20-87133714990b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489692, "uuid": "7c74f1ce-c843-4bef-bd71-ebf8db1e08d5", "value": "5da36e8e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7dedad3-afb1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446446, "uuid": "9ac24ca9-e880-4a4a-a2ab-578ddf7bc9cf", "comment": "Malware payload (Dridex)", "value": "c10824a03c13e85d6e8f41db94f7f752", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446446, "uuid": "f436baaa-0871-4b74-820c-f25e8690c484", "comment": "Malware payload (Dridex)", "value": "0a5585dc2adc24e2f9452cc0dfdb3f1b87a8f2c389e867cb92d59561e3925f8f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446446, "uuid": "d0c16e10-b5d1-4dd5-aa34-647bbcb6076a", "comment": "Malware payload (Dridex)", "value": "af69b83325e3d5e2a4f84cc823e3cb342c96c66f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446446, "uuid": "6e6fdb86-adc9-4f0e-850d-1abcafefbb50", "comment": "Malware payload (Dridex)", "value": "b2bcd64e943a0a9f6b35dec5d82bf98adf09bbea49bb10b4ff4b48a4796a0ef15b370b28f1fc1bd90d8bafde914173b0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446446, "uuid": "b5ab23e1-fe05-4caf-a5d2-ba1106267e6b", "value": "DCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446446, "uuid": "2e503b2d-772c-4047-9da0-16a68ef30287", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446446, "uuid": "10ee7831-3475-4e35-b467-7432b860f1be", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446446, "uuid": "21026006-fc49-4ee1-8325-600b9da00650", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446446, "uuid": "fdef32fe-c25f-49a2-b612-5b443d1a5368", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446446, "uuid": "90b229e2-009b-4158-a0e4-cd40cd1e5e9b", "value": "c10824a0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5592efbc-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "8d1a2817-6d04-471e-92bc-93e18b75d60e", "comment": "Malware payload (Mirai)", "value": "8774f7d98450de52296485bc8bbcb8b4", "object_relation": "md5", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "cfc36b1c-789e-47b2-8d6a-7dd4c67666b3", "comment": "Malware payload (Mirai)", "value": "0b55b8a56e1c0d7bcee16cb478148a4d964573b0a6e1ab6547b664e9a35ff0c7", "object_relation": "sha256", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "0d55d1e3-32ed-4212-b1f8-14cc4fbd5990", "comment": "Malware payload (Mirai)", "value": "6027d63bd53d9c6df0d68ff36105fa1361d66445", "object_relation": "sha1", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "92ba8ab2-fb76-48a1-9a93-b7ddfe4dc5ee", "comment": "Malware payload (Mirai)", "value": "27a917ee5bd5a9fb6929884ba1a650e1bab50c77eebbca86b127dec6d232dd0a82bbc1921f980466fe21ef655d4b5d7a", "object_relation": "sha3-384", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "1ab8f66c-fcd3-44b3-a029-756609202c7a", "value": "8F93504E6E714F7DFFAD823897B79E209309339616A1C684C1ACEE025E70389741FB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "0ec38f66-6d1d-4400-82f9-8880df7e784a", "value": "1536:fUNyqwipEXzKt4kKSdkVz+lW8rfwExjSk7IB6GgoCnvLVvJQEHK9:8mkKSdG+lW8TwExjLMXgoCnvLVvJrHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475380, "uuid": "fb00843a-2b99-41ce-8810-850679a9b217", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475380, "uuid": "4293a014-b6c1-4d8b-8a2e-505eb3cfdfa3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "87833027-d9a4-4025-bb96-41176d6201b1", "value": "KKveTTgaAAsecNNaaaa.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c78df7c-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468090, "uuid": "638120e2-0206-416e-90e9-44657c5fd3d1", "comment": "Malware payload (Dridex)", "value": "93545ef883cf9a6fa5f173f96696e02e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468090, "uuid": "ea26a56b-33e0-4568-8b7e-1b35f41037e8", "comment": "Malware payload (Dridex)", "value": "0bcd0c38dfaa89532ec39051ceac6eaaeb218bb419660d50ea85143bf44209c5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468090, "uuid": "afcc1d34-9410-4882-9ce8-2f93bae05bf4", "comment": "Malware payload (Dridex)", "value": "ecd21431471533d877e937369c0b05d10e4392d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468090, "uuid": "762e4461-277f-4ea8-9f33-ec3d7f3cd787", "comment": "Malware payload (Dridex)", "value": "885fdc2aae3e7942bbebdb60ace2d47cab47bfd6273d09823b94c3d62cef1026552df03a2fa5f55dd8df5efa4c484c6a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468090, "uuid": "c291ecd1-1fec-4573-a3cf-91548cb77911", "value": "BAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468090, "uuid": "cab848d4-32c9-40de-a298-a3679b7d386d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468090, "uuid": "b7c63898-0eb1-428f-a055-b3120e722338", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468090, "uuid": "ed70106b-898f-4808-93f5-7fd3f9617669", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468090, "uuid": "1ebc99a3-469f-4bca-8075-6ca97fce8086", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468090, "uuid": "5dbf70cb-dfba-4557-8625-b010eb3b84e8", "value": "93545ef8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d07826d-b051-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620515013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515013, "uuid": "418352b5-c46b-4d6e-9795-9d760586a109", "comment": "Malware payload", "value": "572252c7ac3dba66c32059efbc6a92e4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515013, "uuid": "134f2081-be3d-44ec-9bd4-d96810c2030b", "comment": "Malware payload", "value": "0bef3da82acdefbcfce92cdee614cddef01b79e0766f25edd70103d9a4df0806", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515013, "uuid": "5d8026b6-95cc-4311-8636-ea62365b982b", "comment": "Malware payload", "value": "1799a7f905d909fbc44e7717b69bdf7282369a99", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515013, "uuid": "5a7e21c9-f44c-4ff4-aa4a-a5b94389743f", "comment": "Malware payload", "value": "531e53ed7f1246019eaa13c76140119cc1b1ee6111387c9ddd7afc3b8c15e8ca21b52c39b35c709e599d17408bb97b50", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515013, "uuid": "1ac29613-65fc-42b3-9447-6f349d0b76e1", "value": "9FF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515013, "uuid": "f7546b1c-e06b-4211-a970-508f7818ccb1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515013, "uuid": "19c6e816-9d47-4da9-b7de-1ed3aa0d5f9d", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620515013, "uuid": "7a3b9f66-11cd-43fe-8fc1-6fbef7bab1dd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620515013, "uuid": "f9334092-5a07-4ea8-a371-ec21fa07a7ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515013, "uuid": "ebd7ef1c-cb01-4aa9-877a-077c65f74807", "value": "572252c7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa802610-b005-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482528, "uuid": "cd3119eb-fe0f-4782-877a-2b536a6ae955", "comment": "Malware payload (Dridex)", "value": "d40b83919e0f9b5f6348297a48e4a63b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482528, "uuid": "a3142d5b-fe7b-419e-a1ae-926b66b6a73b", "comment": "Malware payload (Dridex)", "value": "0bfac177a5a643371aba8891538315fbdef882c7343852135f69b5078a59caa2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482528, "uuid": "78b39ffa-9155-4609-a362-f5c2e61a6426", "comment": "Malware payload (Dridex)", "value": "89b7827f8c40cb725e71527a4234a6aa05130f67", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482528, "uuid": "17663c6d-ee86-450c-b542-dd516b2dac99", "comment": "Malware payload (Dridex)", "value": "1a62491d6058aac0f013231328ce210c3a32076e01a803dbd807a3674a68bb44bb59989ac6efe0468561464b0e6e9e83", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482528, "uuid": "961de1b6-f92a-48b2-9889-5711305437d1", "value": "21F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482528, "uuid": "7858cc8a-c861-47aa-80ac-c734c9d38c49", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482528, "uuid": "986bd9e2-5ad5-40bd-9000-a34c6a6fb524", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482528, "uuid": "8fa8686c-1669-41a2-a187-9c7936e72640", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482528, "uuid": "3ac93621-47df-4d29-b449-4ed74a9df9bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482528, "uuid": "f21976bc-f663-4f68-a95f-678cfac99dd1", "value": "d40b8391_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470bcbe8-b020-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493824, "uuid": "a6f3ad4d-9f83-49f1-87e9-70fd05fbbf1c", "comment": "Malware payload (Dridex)", "value": "083d5daa8183542158e52b76eb70d06c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493824, "uuid": "0c87c0cd-4d7b-4a86-9aa2-e1ed32aa9390", "comment": "Malware payload (Dridex)", "value": "0c009c6c51fbbb02a8541e9d3f99ccae23e116cd39e4695acebab11afa1a6975", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493824, "uuid": "3974d52a-c20c-476e-98f1-a025da70730c", "comment": "Malware payload (Dridex)", "value": "7c35acccb77bd7abbbfd9cd9a99ffa47d7a8a535", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493824, "uuid": "d49c4d7e-3610-4fe3-87f8-c87009f46a33", "comment": "Malware payload (Dridex)", "value": "ce981b990fb5b91e937bc6e29ab87935d875b4dc19e46952bfda3ad6c000692008c832e6a2b58c16b2e3ceccdfd162ef", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493824, "uuid": "b57c6e21-6d33-4ac7-8f7c-6422b57b76e0", "value": "B5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493824, "uuid": "d29d0cf0-96cc-402f-8325-16b391c0adf3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493824, "uuid": "aae10a90-6ec5-4ab0-a927-05bc44794d07", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493824, "uuid": "1e0ede5f-64d1-455f-b179-395e3936b394", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493824, "uuid": "f24917d4-d2d7-49ca-b2d2-6dbd26e0e40b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493824, "uuid": "828614fa-b9af-44d3-a02b-147878240d71", "value": "083d5daa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466fdbdc-af9f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620438418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620438418, "uuid": "2dccf822-fdf1-4ee9-b2fa-02a4228aa888", "comment": "Malware payload (Formbook)", "value": "169763f8e7731554cf5588290a6bc91e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620438418, "uuid": "99bb37e5-567d-421d-98d9-3352656966be", "comment": "Malware payload (Formbook)", "value": "0c5a22c770faa9a49feb2d8c881d51138f4892dad188e3391d345d0865e8953b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620438418, "uuid": "860339f5-7975-4410-bfdd-a84bc8f19d47", "comment": "Malware payload (Formbook)", "value": "d7ae18ba8e1c5043a152bc29aef950c4b3841c3a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620438418, "uuid": "2f427f99-2b1b-41d0-b76e-9dbff3f71eb7", "comment": "Malware payload (Formbook)", "value": "e928abcee366864e66e923dd739ef4223fc99447efb6c3f8530419e896fecf490197dc8d41e9db9135abdf83b36972c3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620438418, "uuid": "1267b7f3-54e0-45ff-8480-66367cb79374", "value": "9E44CE613ED38C66C9F3C67E0CE4AE318EADB1CB2031463EB74CC62C61156918D5E59E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620438418, "uuid": "162f07ab-01f3-4f07-bf75-b1b2407d91f1", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620438418, "uuid": "16142154-18ad-4915-bba9-41e36c434eb2", "value": "6144:29X0G6Z+aDannrE++Rd1hhPC72KugkU9aiL1Ft:40TwrE+41hh672vUMiL/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620438418, "uuid": "e3dcf025-d451-4cce-b127-dc011355e8ad", "value": 263132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620438418, "uuid": "edd3c037-12f1-47ed-9f3c-cb91c1c8c8eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620438418, "uuid": "73006add-5f72-41b0-b077-9e030dc4f725", "value": "SecuriteInfo.com.Gen.Variant.Androm.29.7073.26917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fdbd7d6-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468069, "uuid": "05336c3c-e899-47f2-82b9-68cac8b3ab3d", "comment": "Malware payload (Dridex)", "value": "6b9f96108dc13b3aeb8ff9e03f4265c8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468069, "uuid": "dd311ae2-896a-4bb8-a100-915f1cad8d93", "comment": "Malware payload (Dridex)", "value": "0dc16081d42ce97849f210aa26049d2855721ac068efa2c506acc9f252b1f2c3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468069, "uuid": "dd6b2359-1c58-4e42-aa72-31c6df556889", "comment": "Malware payload (Dridex)", "value": "ee112053fe425425c86cdb67915e49eb54eb0500", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468069, "uuid": "7c1667ac-1e16-46a7-9a34-ad5570a0e713", "comment": "Malware payload (Dridex)", "value": "71c6da94684747bc66c537223135ace59ab6e8869ba5be7d33d9fadcf6563d58625397c476bb7d35d245ecf3caabbcc9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468069, "uuid": "ece58a1e-498f-4f62-8f14-a18cdcd12d10", "value": "CAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468069, "uuid": "54ae827b-88d3-44b8-a09b-0a78ebaae180", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468069, "uuid": "690f39f2-8f34-4294-adcd-f4802e499bbf", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468069, "uuid": "fb9983bd-e512-4dbd-a310-0718826270ca", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468069, "uuid": "78e9d0db-d873-4eee-a2b0-cacfb394f661", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468069, "uuid": "b821ed5b-fca2-412d-8c9f-07911d6311da", "value": "6b9f9610_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef63e13-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478966, "uuid": "67f3cc7b-50e8-4b0b-9dda-9463eb2c5b2b", "comment": "Malware payload (Dridex)", "value": "66cd6a03dfaa7eb7dfb8ed14b135155c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478966, "uuid": "9b010d46-f4f4-4a1e-85d9-12e3c9b0adf9", "comment": "Malware payload (Dridex)", "value": "0e1517da8ef7c393e6522fc18e2aaea1af694b9e711661d8c7a1773e1df6d408", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478966, "uuid": "f99ab6bf-e4c2-4f1b-b411-162b5ddfb837", "comment": "Malware payload (Dridex)", "value": "42b0e465b6e3af3b39ee449b43c92c1964b860e6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478966, "uuid": "d69a3184-a4ea-45c7-be0e-68d50105b078", "comment": "Malware payload (Dridex)", "value": "7f8d0e0e073148d22e89db87266fda472fc0c1f92af67eeec7d3bb05e4029e774bc6db2bdd6d24d5539bf739e9e3e9f1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478966, "uuid": "643d1b8b-f02c-4831-98ca-2e664e189570", "value": "54F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478966, "uuid": "90ad52fe-b52f-42ba-b79c-577fd98d0561", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478966, "uuid": "639bfcb2-e51b-4d30-b0e0-ed62e4a06b4e", "value": "3072:yiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:xeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478966, "uuid": "56dd619b-05ff-4bf4-bd0d-9645b9604c99", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478966, "uuid": "e7b69e03-046b-4a95-b9b4-b79f5ba6a965", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478966, "uuid": "aaf32131-aa4b-404c-b618-36e54e8c1c0a", "value": "66cd6a03_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc8a507-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435665, "uuid": "c3736455-0c02-4588-a472-fc285715ca75", "comment": "Malware payload (Dridex)", "value": "2ab561a3c4115345ec17e4efdc03c184", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435665, "uuid": "89f92c62-6696-4591-9f39-f6b3110e9fa1", "comment": "Malware payload (Dridex)", "value": "0e83c121fa56094065625bf0f6eb5a3a03548f06a88d98696686c3196bfef23c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435665, "uuid": "0737a1b2-cd47-428d-b7bc-f66527e42e4e", "comment": "Malware payload (Dridex)", "value": "3822f009505595eaf06405902e6a257b0e342fb4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435665, "uuid": "3b04c435-d94b-4072-9725-94fde1fcf157", "comment": "Malware payload (Dridex)", "value": "12051eb155739ad29d9156e6c250a95baf0318dc39dcf0d2a89cfc545084ca732f214145cca9d828f3f0f89350186dc2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435665, "uuid": "6a75cfb6-65a0-4fcb-ba0e-5ae3d81e5491", "value": "BFF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435665, "uuid": "9834ddda-68dc-4819-bb5f-fc4240f1cebe", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435665, "uuid": "9fb83fd6-95a0-48f2-922e-2942437f7033", "value": "3072:xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435665, "uuid": "47015ab8-86f7-4f08-80c1-f3c85bcc9177", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435665, "uuid": "9320fdca-f026-4a24-831f-94e95bf13d43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435665, "uuid": "4daadbec-fbbd-4ac2-983e-4107230b6ddd", "value": "2ab561a3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcca8cd2-b048-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620511309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511309, "uuid": "42c7eb32-139c-47b4-82fd-d5417f4faefa", "comment": "Malware payload", "value": "2e68de44d01af92ea7085c651b3d01d7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511309, "uuid": "9a324b80-7447-421b-a284-635fc37bfb92", "comment": "Malware payload", "value": "0f016a2c220cb88c88e2a13b90177ead5a8c9744d862d4a30c780de65a1f6205", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511309, "uuid": "fcf883ae-2c35-4ec6-9592-05ab0f0db18c", "comment": "Malware payload", "value": "5eca40a7e0ed782cc1ca4360fda48e1867fcd7de", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511309, "uuid": "c61fd159-a013-4827-b40e-d98e4dd8d759", "comment": "Malware payload", "value": "47bdfd1921d0e1e4e72efe51b0cd2efc5a8605c5ca0205af53e894ace6e5a98b7efa2657ac8bd514a509f6118aa470fd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511309, "uuid": "c3850c04-df55-4bc9-904f-1de27da69966", "value": "FAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511309, "uuid": "c2f3724e-5723-4d53-abc4-182d8a63277b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511309, "uuid": "28aaa47c-c964-45b3-967f-dea64e98a478", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620511309, "uuid": "ba5cd835-6c75-452d-aacd-cc24dd30f898", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620511309, "uuid": "21446328-b235-4277-9951-8532ce518ce2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511309, "uuid": "002de54e-c45e-4ab8-ad9b-0d3047283844", "value": "2e68de44_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236cbe42-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486033, "uuid": "5ed96ac8-33d8-474b-97d1-ca88c82f7cdb", "comment": "Malware payload (Dridex)", "value": "84a411cc0aa9124280161cf0f21bd9a7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486033, "uuid": "c55ea0c5-8185-4cb3-a5d4-b4b960884771", "comment": "Malware payload (Dridex)", "value": "0f5fbc70d0de921d1dd9a2ad2b0ac2036c00bc3837c633cdad2f4b3f1dfa134c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486033, "uuid": "8b8d9696-c7a0-47a5-b3e5-a1adcc4fc7bc", "comment": "Malware payload (Dridex)", "value": "29cba91bf0ed1642493f5301aaed14d3fd75b6a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486033, "uuid": "39e9a807-640d-48d0-8fd9-26320502a9d9", "comment": "Malware payload (Dridex)", "value": "73f243ffb23471528a222c4f074027d8e44c1f4907e218fb237cf433e0438bf1d9d5e8d932e6856f89a92d4e4b7e7983", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486033, "uuid": "437d6995-d005-4974-98eb-c50b61613565", "value": "DDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486033, "uuid": "cd41f64f-72e2-4d64-8e06-67ecf9953ead", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486033, "uuid": "2bc7a8d7-20a7-4237-93e0-1aec0193b53a", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486033, "uuid": "a8427a37-09d3-4c43-8ffc-af8985257c07", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486033, "uuid": "ff5808e8-fe82-49ce-a818-6b8c9975d42e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486033, "uuid": "c6d60f2a-c2d7-40f8-b7af-9fd95f9984a5", "value": "84a411cc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029506f8-b006-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482542, "uuid": "d98ae6d6-f8bd-42e0-800c-30c931586df1", "comment": "Malware payload (Dridex)", "value": "7556971612e75d825542b654d2cb9fb8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482542, "uuid": "ff274641-c98a-4369-b18d-55afabf0ea42", "comment": "Malware payload (Dridex)", "value": "1014cc5a45f2f99d8f59376625be0f21ba9b347de26f44e229981953ecec4d25", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482542, "uuid": "c2877321-be98-47d7-934a-5f29227aeb1c", "comment": "Malware payload (Dridex)", "value": "234f215c6d5428a62dbe10795602fb0951a2e89a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482542, "uuid": "5729d790-3ee7-48ab-b102-9df3dee643f5", "comment": "Malware payload (Dridex)", "value": "50a489933405c6ddf3b250868885cec148a2386b44835ba280b7edffda7f448da6810a5333674745a58d51bfc2cd333b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482542, "uuid": "0af9939b-b81f-4f13-82e2-c1d71392c804", "value": "F7F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482542, "uuid": "f002a135-c225-40bf-bd6a-5db7a48683e0", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482542, "uuid": "ceb041dc-2bdc-470e-9d54-b9de4f59c0fc", "value": "3072:Tlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Tlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482542, "uuid": "3984bbc0-7cfe-483d-bfaa-ec82acf00f02", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482542, "uuid": "6ee85fe6-b46d-49fa-a3ec-ba083e04d2e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482542, "uuid": "32c29671-1e70-4028-a447-363f627dc952", "value": "75569716_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35816fc-afd7-11eb-abe1-42010a9c0039", "comment": "Malware payload (TeamBot)", "timestamp": 1620462679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462679, "uuid": "7d7ff5f5-47ec-43ab-8b90-7e30608c3922", "comment": "Malware payload (TeamBot)", "value": "832879bd5ea455e58a4cf2930073d02a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462679, "uuid": "e25849d0-9372-4ecf-a6a8-289a14aa7716", "comment": "Malware payload (TeamBot)", "value": "101648667ad547177c6a6bfd210af66397cd0a7e0ec3e4b2b98ecfe5963a293c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462679, "uuid": "c3748a7b-c6ef-48a4-8dae-c147c40f75c8", "comment": "Malware payload (TeamBot)", "value": "c1866e66183e8d12fb8d75849952b85e8167904f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462679, "uuid": "3a762c03-eff6-48a5-950c-c22a86ac5aaf", "comment": "Malware payload (TeamBot)", "value": "be32d691d40d92559e2b3ea9b512fc25baeb5d5b2ef844ca1c561f3740af548db62579d7ac5203f0cd042ab9a20de793", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462679, "uuid": "0e8264fe-6f27-4069-8253-156fd261d2a4", "value": "8F15011275C0D072CD661D794065DB688EABBC339B624E8FAACD2779EF247D1772030A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462679, "uuid": "85f04fd5-7c25-4f31-bb8f-23c69580645e", "value": "0eb744574666f2607e9c304d58194156", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462679, "uuid": "3cb6ac61-f99d-410b-9bcd-3aa5c70cc339", "value": "12288:csujI+Lu/+3YiVNoyPGcyU9vLxssWHtafFwlLbIPwtG0eSs2A5AEjuPDVJLmUx:csuM+LYYY9yPGcyHj0qlLc4aumuP2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620462679, "uuid": "528ef42d-8cb8-4399-90f1-085922c2e618", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620462679, "uuid": "2fd853a0-a957-4dc5-9a23-1622cf5b3405", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462679, "uuid": "3d6df17f-f454-4337-b5a5-2980073479b0", "value": "832879bd5ea455e58a4cf2930073d02a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3732d146-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486066, "uuid": "8e55a091-ac46-4174-8719-3f3129becc38", "comment": "Malware payload (Dridex)", "value": "dc0249eb65854031c78a3dc5121180a2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486066, "uuid": "546f49fb-2d00-4304-9f16-992c5f8062f3", "comment": "Malware payload (Dridex)", "value": "1027f0f9ff0a41a2cdf849850982a8ef737dc3fe5758a86db8266cf5050fe7bd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486066, "uuid": "db089058-d253-436f-a1e1-e8c56d58bd41", "comment": "Malware payload (Dridex)", "value": "7950e9a8b692c95aeec19b210f542a0131df1069", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486066, "uuid": "83a3af02-737d-4ed3-9612-1eeb81ad1bf7", "comment": "Malware payload (Dridex)", "value": "9ab64cf2f3c2b6c57efcc8fcdd904dd5579fddaa982a2313edd2f1e2e2caa37773249f09e9b35da07cb2dcab28526a46", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486066, "uuid": "aa7a43f9-6e02-4db3-8027-e1784c900441", "value": "78F3E00AED9FE988E85C51F1CA4D363EE9713E361B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486066, "uuid": "c112e923-77b0-4eb1-a7fb-3009852381b4", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486066, "uuid": "4512ff0c-958b-4e02-8c4d-3942b4ef352b", "value": "3072:XiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:seAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486066, "uuid": "69370293-56ec-41d6-908f-cc31824b4d0a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486066, "uuid": "26e2171c-6838-4219-bdae-29be6339b5c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486066, "uuid": "686dc2b5-037f-4b42-8c9f-cf187b66e19f", "value": "dc0249eb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b891397a-afb4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620447629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447629, "uuid": "5990b47f-7398-40a0-850d-4a4fba929a2f", "comment": "Malware payload (Mirai)", "value": "e9782e7ee9b0916e8f816e11b2812be1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447629, "uuid": "2c521e61-01db-4768-9a90-e5a6fdf26bab", "comment": "Malware payload (Mirai)", "value": "1089653a5c3f14aa711f71e253f1943a0cf7204573d3ab71438108ed906b419d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447629, "uuid": "14c2aee8-0339-43a8-828a-d87cf3c414b0", "comment": "Malware payload (Mirai)", "value": "badc6e3be06303cd96a677a6bac96e3d64b6c39d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447629, "uuid": "3983ce4b-a467-4fa1-8986-38cba8429b20", "comment": "Malware payload (Mirai)", "value": "a9f48f293eda21659ee302f84880fbccf8bab8e636027b52f61e741705eed3ddf3f766231364fcdb4b5ee07b05d26e2e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447629, "uuid": "25ac742f-f609-441e-9716-5ae1d77352b1", "value": "A303E166D088A2D6CDA00C29E9A8110761E7EB3CD1DD3CF27A18E71C9CF7B895DE5178", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447629, "uuid": "615d6f51-59e5-4814-8ab9-a0a0f3d02897", "value": "768:PgY8T4BBseKcpQZLcJdy0MZyajc81PVNVanaYJReLBDzr1q3U7I:/6NcSZ2dyVUajceRavReL9f5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620447629, "uuid": "84810913-8599-46ef-a1ae-e537e34a6f6b", "value": 39304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620447629, "uuid": "a379b071-9fa2-4d01-8cf1-a344efbad791", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447629, "uuid": "f707ce94-f881-41da-ac8c-34cc52271c92", "value": "ARMV6L(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ceef02-b01f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493681, "uuid": "c240736d-8586-44d2-8e40-d88cacb3a217", "comment": "Malware payload (Dridex)", "value": "c997d397dd7c0927ab9d8af2f2355529", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493681, "uuid": "d3baf9c6-d998-41af-bfc7-ad6cf6de5a02", "comment": "Malware payload (Dridex)", "value": "10bf829430b30531790797dd7e7db598ad7b14eb225879ee1c956eb27ab3ea5a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493681, "uuid": "0457a54a-0d6b-44ef-a49e-068c683dff14", "comment": "Malware payload (Dridex)", "value": "230219b9484314f16feb2f3d51d4b56cf7b7cdd2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493681, "uuid": "95a44876-6caf-4ed3-8cea-709cc5cd4fa3", "comment": "Malware payload (Dridex)", "value": "cedc3cc44bae668f1fc5154474bd97467850ff536d9f7946dbf9e463655c5da8d9f7f15e20b016db59ab36232ad324cd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493681, "uuid": "bd128e0a-644f-4763-a379-ab533ccf9483", "value": "0CF3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493681, "uuid": "cdd4b4cc-63f4-4c56-a0bf-76947997193e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493681, "uuid": "8e8031a5-ebc1-4a7d-8643-ff1fab9ec2b4", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493681, "uuid": "b7bd6390-bc3d-4ad7-8db6-8d59e1b5f7af", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493681, "uuid": "d374acd8-d090-4ecb-b278-fdbdb04c659c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493681, "uuid": "c26b7525-9c6c-4ead-b8be-d16b71006a20", "value": "c997d397_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da53f7da-b026-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620496648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496648, "uuid": "155e9d8b-0664-4804-b570-2ae1986b9b1a", "comment": "Malware payload", "value": "ed9cd32c1289a2d49cec62f9666c171e", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496648, "uuid": "e44bb65b-6748-4a19-b057-7ede91c4732d", "comment": "Malware payload", "value": "1112423db7e3af4f23267cacfc4f9edcc9180531415b8341f311faa5b2855430", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496648, "uuid": "c87cedfc-7223-4e96-9435-be8989e058c1", "comment": "Malware payload", "value": "93c6d868fe0b1363aca94c26ddb0aa2d1a8ceea7", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496648, "uuid": "0ba2e8e6-8497-49c5-b75f-02afe0c0a7a5", "comment": "Malware payload", "value": "8f2f59504e791a38cb56eb32f568cab473590b8fd3b50d563fe2a25b09d50fa4e27bdcb4152597342c81f4cf3d4af3bc", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496648, "uuid": "75ae2fc1-94cf-4646-883e-098d92836d49", "value": "2D241299D4D6EE2BCF972436C6D55FA76263A061A2F3BC2CB109F73CF644D0294A10C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496648, "uuid": "c39a1713-5eff-4bcc-ad22-ec81cdcf30a6", "value": "6144:RtCojEIO+/ENhLv5xyGBVeJZnC469axilrxDn:DCojEn+crRBjeJZ369KYrx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620496648, "uuid": "108f8299-9191-42e2-a27c-c5724ca7fe4f", "value": 225270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620496648, "uuid": "d80627f2-9a48-4623-8ee0-1f3835a328f9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496648, "uuid": "4cf85549-a403-4675-b9c1-756af4765c79", "value": "export of payment 2993132.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57225e4-b001-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620480695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620480695, "uuid": "6f434c9c-df6f-495f-b00d-fba09e73ca2b", "comment": "Malware payload", "value": "fcc260dbb9465ac34ce760ffd10d5251", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620480695, "uuid": "b05b344d-db10-4768-ae8c-1f0b825196f7", "comment": "Malware payload", "value": "11283ae4fb02abb3bb3b2a52df986917aa7d671a2e4a6390c269452de4c0acb1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620480695, "uuid": "592a36a8-2390-4494-8a8c-71c39af8c3b5", "comment": "Malware payload", "value": "a5aee1434cb817ebfee05aec0f31afb64a89aaf7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620480695, "uuid": "88f937b4-a1b1-4c35-bb74-16c54813c86b", "comment": "Malware payload", "value": "870c42a10544ba5a4aa135a4390e64e9504e420f0a7d12ff20ba27ecce02495438d9da197e6decc2a0377990bf68e758", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620480695, "uuid": "6d6e39bf-b3e0-4f81-8ed7-95ee094d9561", "value": "4DF5892BDD189B2FE49A147084372F51335DE69F2A40872F63BA270F2DE5745ADE28C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620480695, "uuid": "3acbd24c-1af1-4eea-b11b-91c0ee5382bc", "value": "49152:2n81hYR0JwkgavZUQ1pe6uZ+uq3A8d80EoxKIjsLAT/d1wc+u25jfsX:281hRgavyQ1pbluqJbsYLq75sX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620480695, "uuid": "b24106c6-bc77-45eb-a80c-ae1dece97bd8", "value": 3390051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620480695, "uuid": "adb2a6d6-a4c8-463f-b575-50f8f0afdec7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620480695, "uuid": "1f9a7d1b-887d-402e-afcc-812dd66c0b72", "value": "WPS Office 2019 - v11 2 0 9431 _ Crack.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be75e725-b051-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620515069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515069, "uuid": "13970567-6d5e-4c47-a31d-fdecdaed9008", "comment": "Malware payload", "value": "951698ad94934140e08b7b9a26ff40b1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515069, "uuid": "c54f0205-2cff-4cd3-bb2b-61204828ac71", "comment": "Malware payload", "value": "11343e0027cc1697e2a789d052ac022c2d1d3cc8104696d9b7bec3102f2abc89", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515069, "uuid": "2bd1c1f1-f37a-47d5-a9d5-04d01065e529", "comment": "Malware payload", "value": "2d355b5d3c723265dfd2fddf07a49df43c9c346f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515069, "uuid": "b3131473-296e-48a0-ad8b-b89e33f3f742", "comment": "Malware payload", "value": "da84306fd797639c8ad0df119b10a040b12fa579018add1384523ffa6dd9589ad6f2f3e4504992d51ca25539f46a1d9f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515069, "uuid": "b9cd4eee-cf8a-4c04-818d-2202aa1b8c38", "value": "69F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515069, "uuid": "04f7be23-d592-473a-9d51-d55c231b8835", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515069, "uuid": "615e32c2-809c-4009-85d8-843805788e6b", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620515069, "uuid": "9103a2e7-34ac-4435-9477-0b334f486eec", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620515069, "uuid": "4b3cc21e-e051-4437-9d44-6afd5f073719", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515069, "uuid": "9f48a9c8-6743-4fe4-8e31-fdb99bc8a3fc", "value": "951698ad_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1db3f00-b051-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620515102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515102, "uuid": "acc1ca62-289a-452f-8380-d3c355bd3615", "comment": "Malware payload", "value": "3bbf166cdc710b617b82cd72e044d42a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515102, "uuid": "f86c0a9a-20a5-408c-a4b5-e6be6780ca65", "comment": "Malware payload", "value": "117c5ac80703f2cef25f3171e91f8b5f0ffe38382bde63a850926b17a8558b00", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515102, "uuid": "11238d92-0845-4a25-8312-90d4b2f115a5", "comment": "Malware payload", "value": "e3cc875de5b162760d399e828633b823cb375c1b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515102, "uuid": "5cfab06b-b4dc-420a-9869-023115337ad2", "comment": "Malware payload", "value": "38e7c96a6418fc3a6d3c119b47e92b83d02267c291f9e6060e040f3d6c577e4c710c55ae43e21777c99d9ff426998651", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515102, "uuid": "aee3e56a-129b-431f-a787-d0564a519128", "value": "E1F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515102, "uuid": "09c2ad35-2294-4fd1-98d4-159e0591ee14", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515102, "uuid": "7d102ab0-5ecd-4f2d-82c9-45bb36fc5202", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620515102, "uuid": "9d134603-08d1-4734-a5be-948861e76945", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620515102, "uuid": "6da81271-9021-4353-88b7-c4ffac3fa9dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515102, "uuid": "50e9b382-e281-42ba-bccb-8edf824d2b63", "value": "3bbf166c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5903e0e0-afba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620450045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450045, "uuid": "0d1b89d1-c49d-4d04-a231-143fb1284876", "comment": "Malware payload (Dridex)", "value": "80ef8713872cc3e70cde30fe20d17896", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450045, "uuid": "67124d16-c3ab-422d-a6c8-4bbf7931737a", "comment": "Malware payload (Dridex)", "value": "1182a9ce794f9f22ad22167e3fbcec688b6184f6208ece8b83caaa9ee5be8716", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450045, "uuid": "ed063d13-5ff8-4fcf-904c-cdb09fa8c4d2", "comment": "Malware payload (Dridex)", "value": "629956795186f1c6edd968788f1e1fa141ede99d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450045, "uuid": "a1424db8-1f2c-437d-b958-8a887f31cc59", "comment": "Malware payload (Dridex)", "value": "520ac14800ffc139368475b980d445b800a0f1d039f4a9e3cc114c816a093a691e1a6f9006c0f9e839b5d9c5ebe9d060", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450045, "uuid": "2b686420-8502-4412-80d1-3502589b4262", "value": "4DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450045, "uuid": "12f8ea07-61ef-4854-927d-78d570ad5734", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450045, "uuid": "377b03ae-763a-41c0-85d3-171624e34cc7", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620450045, "uuid": "54218f38-b794-443c-bef1-7c553da1d629", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620450045, "uuid": "f244715d-f175-46da-9fc3-5d218445cf2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450045, "uuid": "83ea53a1-793f-4ee5-9195-8a35625ba8bb", "value": "80ef8713_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5875ee86-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457346, "uuid": "6d2748a5-d43a-4151-822c-0832597403bb", "comment": "Malware payload (Dridex)", "value": "b14dfdd324ae93417b5e05ec68d69fcf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457346, "uuid": "62f36f39-10da-4a29-912b-866df99a6952", "comment": "Malware payload (Dridex)", "value": "124c4a59492a7b7aac83164ffa6c414ffddc807d973a1d7446248ae17106ee8a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457346, "uuid": "a889b817-a6ca-411b-8fe5-754970d06cb7", "comment": "Malware payload (Dridex)", "value": "b325a260f13d11149790d678d524416ea2779a43", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457346, "uuid": "5f5a011f-ba74-4fd6-a448-56fedd371068", "comment": "Malware payload (Dridex)", "value": "9c1cd92e7fa318cc3554c4a83c213137efa1427d0d7f71164ef52e59b711f5c7f25d2ed89a0f49c4f920d53533d8c46f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457346, "uuid": "949b4473-a532-46a2-a9d0-2c4b92645242", "value": "ACF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457346, "uuid": "de14a0cf-8794-4d4f-bff3-a4ca360a336a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457346, "uuid": "42e01fea-ed68-41e5-af10-381450e2c850", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457346, "uuid": "7757cb11-32ce-454f-89a0-16ee3025d6e5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457346, "uuid": "85b08584-d056-477d-af7e-b1754ac9f643", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457346, "uuid": "fbda6ea7-f311-4842-9a16-66847a366768", "value": "b14dfdd3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f99a1cd-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432044, "uuid": "f85d2f68-406e-4f50-a5bf-04dd12156ffe", "comment": "Malware payload (Dridex)", "value": "512dbf1806b4c6daab3eb19ef2c99a6e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432044, "uuid": "e9a0b880-a85a-4c0c-9d57-8f434e5c5418", "comment": "Malware payload (Dridex)", "value": "132fadf8b963db3fdb662be42a543fe8019ced42b38835ed9995f0f40320354e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432044, "uuid": "b77a4e85-0c8e-44bd-a468-7d46ef710b61", "comment": "Malware payload (Dridex)", "value": "42353c001376da3e9716e1f6c9821c242bd5f665", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432044, "uuid": "8e5a1d96-1254-41b4-a7c5-fbf6fbb4a1b2", "comment": "Malware payload (Dridex)", "value": "bda2c6ab038e626cb4952b923799d20795f11410b029b6201dedddf904d75f217d0966fb63d9a25051fd38cb7f44d147", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432044, "uuid": "95ab4e9e-b2a6-4e81-ae54-8e43282efb0d", "value": "98F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432044, "uuid": "48f65eac-ee80-463a-8980-567468fa0e0f", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432044, "uuid": "94274e75-a898-4b83-998c-c1ee48576a36", "value": "3072:9iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:GeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432044, "uuid": "b8bfe468-9f07-4661-96d4-2fbc164ef642", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432044, "uuid": "871620f8-469c-4ab1-b2d1-9b43f68be512", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432044, "uuid": "c94fa99a-48a1-4b6e-9853-67b214631531", "value": "512dbf18_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38661998-afd7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620462446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462446, "uuid": "12a6290c-963e-4591-b24f-266548305f82", "comment": "Malware payload (AgentTesla)", "value": "218877caea0646dc4be5c2a163406646", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462446, "uuid": "fc6cf427-a225-4718-a7f0-b3bf37a9020a", "comment": "Malware payload (AgentTesla)", "value": "1334afcecb05895ccedf182affa83c529e1416b3ceb296bd96c558a19bcc1e15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462446, "uuid": "cf7fbdd3-9f87-4458-9277-b5976fd1bac6", "comment": "Malware payload (AgentTesla)", "value": "8d82c4ffed9ae8b527a598e25487549d7143db20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462446, "uuid": "3240422c-1e44-449d-8790-299cfb3e77fd", "comment": "Malware payload (AgentTesla)", "value": "1dcdb7962bd6903faa0905e0d15094d2f1045629a190247c8bd91045008d1ff06f74174cf6de5b6b05739469bb3441f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462446, "uuid": "9fe01e08-27aa-4753-b21f-70d405ce0bce", "value": "4405017533A89B55E2BDA7352560A25403F1BC11E733DA0D7EE535EA28B3B804BA3707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462446, "uuid": "8ab36dfa-f3ef-4bba-a704-e7f272144b01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462446, "uuid": "ea00073a-e469-4f6d-876b-1f548eb1f20c", "value": "24576:xZ17WFto/WulViNjT4SV5oAlGwdrdWUJk0z:97WFtohlVYoAlPXWUVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620462446, "uuid": "f1f2189d-aa33-47fc-b498-79f16e343654", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620462446, "uuid": "d33a4bc0-c8d2-4e50-b794-ac8900629322", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462446, "uuid": "bd1cbcfb-2688-44d7-8be0-3f982c9c4c10", "value": "Statement of Account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084aa075-b006-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482552, "uuid": "4181ee44-6993-4978-b804-c9d4ed0bb5af", "comment": "Malware payload (Dridex)", "value": "dda695647ca79c32f6a35f60d3284b17", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482552, "uuid": "6f8e99ff-8263-44f1-ac00-1aa8c9898a54", "comment": "Malware payload (Dridex)", "value": "1387a28dce5f9e9dcef7156f02aad6e5b3f970c65e379c40d07e4efb33e1366b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482552, "uuid": "abc83c27-bc76-4071-8026-e72d0c650d31", "comment": "Malware payload (Dridex)", "value": "e93b10f366008acd249822fcaa969794173b73ef", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482552, "uuid": "bcacc264-3aa9-4fc7-a0e0-4057a2f63ae6", "comment": "Malware payload (Dridex)", "value": "6c4ee33088f9fb73900aea37f075763097354e25ef69ae87e58918be358558217fd984c9e02474e8c71aacef99034f41", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482552, "uuid": "514baa56-0796-4ec8-a15b-8153ff6a8c22", "value": "2CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482552, "uuid": "95a9cba5-4581-4b05-b4be-ae31f5970483", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482552, "uuid": "dc8b97c6-d2db-4138-9832-fc1e5e60d68b", "value": "3072:Jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482552, "uuid": "f073c5e8-9417-4864-9a1b-65768ae93acd", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482552, "uuid": "043827bf-d35f-4867-9f88-ee3f91d2aed9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482552, "uuid": "09863c88-e6b7-4869-8b89-7631dc0f532e", "value": "dda69564_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411ba50b-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468044, "uuid": "05f03ec0-6a67-4a33-a6bc-649549f1a87e", "comment": "Malware payload (Dridex)", "value": "dc3acd7b55e1767fd537395daac123c9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468044, "uuid": "17671431-e48e-4168-8e84-543c50056a15", "comment": "Malware payload (Dridex)", "value": "1396b811c92507635a8e790064eb9b33379622d52acea84a951351fcd2b74fc5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468044, "uuid": "60342aa2-cd87-4053-8689-37125fb9da0f", "comment": "Malware payload (Dridex)", "value": "8e2c162e9fc0d860b21e7be38c5ff86cf39c1fb4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468044, "uuid": "ed64008d-d6fe-462f-acbe-eca9a55dc441", "comment": "Malware payload (Dridex)", "value": "f949f5f9fc5e25e251fb3c8f7c6de3e9137dcba27faac089189f40794aa4bbbec0fdc589e3d4d47d847883d8b71ce84f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468044, "uuid": "4914bfef-e6ae-4227-8460-f1112d9ac807", "value": "C8F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468044, "uuid": "098a2eed-a041-46cb-a053-15d4e3572b34", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468044, "uuid": "58d1f548-f8bb-47fd-9067-ee8756f40707", "value": "3072:2lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:2lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468044, "uuid": "7c36463c-cce5-4dbb-bb7c-8e4bca25f49c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468044, "uuid": "45497969-2e3d-4af7-818f-75f29fe0f0f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468044, "uuid": "db4d00a3-8cdc-46c6-9cb6-c131858f9529", "value": "dc3acd7b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa02040-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478940, "uuid": "5cdc904a-30fc-46af-9486-64c2dd97df6f", "comment": "Malware payload (Dridex)", "value": "6031a95ff0d2f08e1d63d4d13667a4af", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478940, "uuid": "de096785-2b0a-4816-a5d7-2143660630a0", "comment": "Malware payload (Dridex)", "value": "13985465d41c7201b8da0f01098d56fda1f81b28ce18ab2dd17327f74c69dc69", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478940, "uuid": "e0e68502-69cb-4f8b-b0a5-e957b99bbef7", "comment": "Malware payload (Dridex)", "value": "a9f0433f9ab978c8c8a03b8529b18b474d61130a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478940, "uuid": "cf630774-c042-419a-9b83-49a6c5c4dc68", "comment": "Malware payload (Dridex)", "value": "f1f1e7d2e9e3d911cdac864b7e83fe0fdb8415d9013a564974496bd87ecd899973345ed46a865f9316987c52018872a2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478940, "uuid": "4d228dd2-2355-403f-b884-95ed71426ee8", "value": "C6F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478940, "uuid": "cb32b0d6-ab50-4241-b352-15e9d079a41c", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478940, "uuid": "114b966e-fdfa-42e5-94b1-65e1be974c73", "value": "3072:qA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:q3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478940, "uuid": "f0049305-6871-456c-ae3a-aca06b0695e0", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478940, "uuid": "f6ea4052-f4fc-41a4-8b7f-e7ff0ccafab2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478940, "uuid": "f0bab59b-67c7-4305-adce-af621fe8acf5", "value": "6031a95f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584bc7c3-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "e047e00d-72cf-4eca-975a-18f8aac83a43", "comment": "Malware payload (Mirai)", "value": "d00102999de300ef378c283be5900761", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "07dee72c-17b6-46ab-9083-80ff3a7039d2", "comment": "Malware payload (Mirai)", "value": "1404602770173b801b6693786fb0e89c0677ed05c7a8512a51f57dbb3902e110", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "894294cf-71da-43ad-ab79-b71fce2e4cc3", "comment": "Malware payload (Mirai)", "value": "f4d525f03fa10f57326a9acca68c9da1ffae1a07", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "a18c0079-55c5-4f36-b7c1-fd9825ae64da", "comment": "Malware payload (Mirai)", "value": "90699ac280adfe7346507768afd991d3e8a1a032dca270bcfbdee4aeee99c7acf47936fabb638d53a509306253226dd0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "338f0cde-eb47-4c5e-adbc-9280dd5837e0", "value": "19F2F1E8E1517948ED4F5DBE61CC2BF31A453181B1CC8A4C8229ADCB76635EEFC1A631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "38cec439-5b75-4b8d-9dff-4e27e01d6233", "value": "768:kJ42S1mX0gNc56c1HmfNYnzXh52O3KAdi9bmCw2WKQgY+o9W7H:OM1ngNoXmQXh52cKAemCw7KJnPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475384, "uuid": "ab83ab56-c811-45c2-bb93-b1ecec1bd016", "value": 36912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475384, "uuid": "d86fd26c-e673-47d6-998d-9e7e1ee5386d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "76b72647-b7af-49d6-ac65-7fb84bb1b276", "value": "xd.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd9f5ea-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460868, "uuid": "c0aa64b1-eeec-429d-a372-b1891352d89d", "comment": "Malware payload (Dridex)", "value": "5b16a567f3c5b0bf41d7c5f831602287", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460868, "uuid": "847486b7-e5b2-476d-89b4-17c30dfd63ab", "comment": "Malware payload (Dridex)", "value": "1415d64dc95997d41db3779d211834554de5c1bd8401822edc4ca8a1461f098b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460868, "uuid": "f34d7f0d-5325-4007-8010-97a364fb7ce4", "comment": "Malware payload (Dridex)", "value": "2737fa06942363113827705a1eddccd1b8820b59", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460868, "uuid": "6a167b15-b6d8-4874-b60e-dd12355a57bf", "comment": "Malware payload (Dridex)", "value": "fb8ccdba908f0c2167db14e21fd45cc9a09c49aa0b502531b872e6fa400d124416ffaccd802c82671d58d858102b208e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460868, "uuid": "ac55cc93-76b3-4806-ae5d-e0711ac571ec", "value": "7EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460868, "uuid": "95335bef-c299-49ca-81be-83d863a3aa43", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460868, "uuid": "d5106f3b-4a10-4ac4-9588-e49ddc5cde38", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460868, "uuid": "e09ad3ce-9a70-4a25-afca-5c084641458a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460868, "uuid": "411c1707-4b4d-44c6-804d-06eeef5da9cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460868, "uuid": "fa287ccc-0f43-490a-aba4-882a48601010", "value": "5b16a567_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61ad035-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478978, "uuid": "fb99efaa-7272-4333-a11f-b6e9d30aeb4a", "comment": "Malware payload (Dridex)", "value": "bf86bd31bf1a422ebb57d6b873c1fdbc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478978, "uuid": "cb4aae6b-6942-4278-8f46-30bb3cf3bd40", "comment": "Malware payload (Dridex)", "value": "14c5ff2e93c7d2d1cb1aa03d943bb9e6129a604ed34ffa9b71395eac4471a0e4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478978, "uuid": "201c95af-ac5d-41e2-b13e-ed15aff99f03", "comment": "Malware payload (Dridex)", "value": "1241951ab6b28d0ae3ea14ee47a64d1a08465a71", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478978, "uuid": "d6a56a63-0723-4ec6-8eec-e32955ee62c3", "comment": "Malware payload (Dridex)", "value": "458a63ef2a9d1c344a1f8f40f73c9f59ac7db31ca0f62214249a0c3c730ab530ffe6e40fb20d2b0bdd6cabe6d158bfbf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478978, "uuid": "04fef459-62f4-49fa-ac1b-45d1c33768df", "value": "4AF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478978, "uuid": "1dda9321-800f-49ae-b09d-8c14fc3c94f1", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478978, "uuid": "d65177ba-00e1-4979-abfa-62c96cbaac38", "value": "3072:EWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:E42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478978, "uuid": "91de2e05-3fa7-4eb5-bb25-36df813851ab", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478978, "uuid": "5b475938-80ab-4c31-9aa6-536889216849", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478978, "uuid": "785353c2-ec56-4df3-9161-c6b29aeeb59a", "value": "bf86bd31_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5672a98b-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "7e36ffdb-b5f8-48aa-816c-2291386cac4b", "comment": "Malware payload (Mirai)", "value": "af2ca955b88b63c4720fc2cc03a21595", "object_relation": "md5", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "c6dcf97c-6e7f-41bc-a283-c4f1f0d180c7", "comment": "Malware payload (Mirai)", "value": "1537e90d978c818d8637e9f5ea1ab2c8da44548ac8b2e28b1d3b35c4bc664392", "object_relation": "sha256", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "aa69a4ea-e4c1-4fdd-bda5-dadae1b4a604", "comment": "Malware payload (Mirai)", "value": "d06964eb4ab50566e0361f1816665087c9676ba8", "object_relation": "sha1", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "1d645bc9-4b8b-4743-806a-490913e72625", "comment": "Malware payload (Mirai)", "value": "c4ea0068e5d17f6ced126b03b715f36fa8bcf28dd8b00861806268c6bc8d3a132a729a5f5ce6868200dc4fd4a6cd0636", "object_relation": "sha3-384", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "dcc26bf3-2a2e-4ce1-ba4f-e540587800c6", "value": "F2C34C46EB418B13C0D5177ABAEF42453322E754A3DB730699146FB43F86BAF0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "e7f67b03-64cc-4b7e-871a-e6b7720873fd", "value": "3072:ZRZJrvGfZKlbhkRB6s7xUiuU9DsH6YOM/9bihfL:fZJrvGfZKlb46s7xUVUqH6LM/9OhfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475381, "uuid": "a0c1dd7b-7620-476f-bc9e-6897c2da202b", "value": 119157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475381, "uuid": "728ecec4-2e79-44c9-a583-03c37fbdfb7d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "7cdde98f-b61f-41af-9874-81067ed00b01", "value": "Winbox.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a06bdef-afa1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620439283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439283, "uuid": "39292c2d-0cfd-42d7-9e1f-2533d8e5b72e", "comment": "Malware payload (Dridex)", "value": "b7601b63c20e65be23428fd90cab853f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439283, "uuid": "d0e0c547-4386-4fcf-843f-720b80368939", "comment": "Malware payload (Dridex)", "value": "1546f56c4190170c67bac7fb8558161a3eb1d0e8a8ad23bfa366eebac6788d47", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439283, "uuid": "45fa5971-e2d7-4dd3-874b-e04904380d11", "comment": "Malware payload (Dridex)", "value": "6ca06ac56b8e02d14e0087d71078c6c4fbb43a80", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439283, "uuid": "20861846-d15b-4597-9294-344738d37fbb", "comment": "Malware payload (Dridex)", "value": "e7188a33a8bd81d9a79699ee92056737c757a2b98000b5b817a09d343406182f0cae9ba8981c035ea4d0f37287da5693", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439283, "uuid": "f32c10e3-4705-4abe-9b03-b44360ae36da", "value": "92F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439283, "uuid": "ae39f5c9-51c1-4089-98b3-8e3ff2ee3610", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439283, "uuid": "781813e0-bae5-4f94-894f-7272746ed9bf", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620439283, "uuid": "c08b1086-c681-4f12-b5fa-7e39f40ba199", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620439283, "uuid": "3dd7c288-8415-4d63-b10f-a16ddf4ca840", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439283, "uuid": "a93a201e-7018-42f9-9465-e711a66c71f7", "value": "b7601b63_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3af6748-afb1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446439, "uuid": "261c99e4-6a1f-43f4-9baa-971a58be59ef", "comment": "Malware payload (Dridex)", "value": "fd3e403f35c066c8ddf1f72b55fbdd98", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446439, "uuid": "65ea3689-9894-4b2c-bed9-3b0732a82af7", "comment": "Malware payload (Dridex)", "value": "156de167f5c8e2a4aae05258e708021cd2f50b3302dad40a315f5d33172c5852", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446439, "uuid": "94f1b04c-1a70-4427-993d-dceb6b7db179", "comment": "Malware payload (Dridex)", "value": "402d66bed9993a617435b02d18e435a4a38027ce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446439, "uuid": "0ac9049b-e3b9-4fff-9789-4060af28e4e1", "comment": "Malware payload (Dridex)", "value": "69f08867a597174db41c160a33eea8c657a3eb795f72c71442cb3f98a72d477a19b73a25053247a77234ccd43f98ba0c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446439, "uuid": "c28ccbff-5d61-44d9-b7cc-190ae0f2df57", "value": "54F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446439, "uuid": "1289e603-6703-48a6-af42-6298cbc377b8", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446439, "uuid": "c53b6b3a-0866-4773-9ad2-bdbc425e25e3", "value": "3072:3lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:3lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446439, "uuid": "556449ea-bff2-4cec-ba72-6bc319d03a1c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446439, "uuid": "289d9c55-ec0b-4752-ae2c-f2ca2bdff7a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446439, "uuid": "6c568c7e-2d08-48c4-932c-5f9ce050d7db", "value": "fd3e403f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551038cb-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620475379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "07136ce5-9262-4f93-b3f3-c3a856c635e2", "comment": "Malware payload", "value": "7f844c04bf6457f68adcc2164496f3c4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "f1a665c6-eb99-4761-b642-37f8c90f966e", "comment": "Malware payload", "value": "15d0e75611b7ff6c1e03a7fbed78824b345531819092174e7ecc349e94c93d10", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "0e738a08-5411-4853-a545-00221f2b616a", "comment": "Malware payload", "value": "b079bb390f8225151a41a8ab042745ac0270c952", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "3b94b6b5-afe9-46ac-9cd1-49eff361596d", "comment": "Malware payload", "value": "d63f64c11c1f54f9c3a9b0512b498263c1d3908adbb76625f0b195c0e035403e9f7114c2f6a88dc7ad356c57d7599797", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475379, "uuid": "1d47eea6-e60f-4a1c-b3a7-cd4ffab11af7", "value": "2BE2E1AAD79A6BA4C67733B83C99D7D063A4CBC1BDB18FA17141DD107032A231494EE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475379, "uuid": "6285dacc-9f2d-441f-bf22-5bbc7250f209", "value": "768:/NQWQX1S4WmR45ByigobdHtyjdxLQSi3HNNin0JI24uVcqgw02TWXs:/NQWQXemuB1btgdaBXi0X4u+qgw0cWXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475379, "uuid": "3136fac3-cb98-4efc-b8da-14ec4efab7b3", "value": 33480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475379, "uuid": "5ea8c46f-b218-4a69-9770-d60e2b57c62c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475379, "uuid": "0ad5a837-df9d-44f5-9e83-2e3f77585701", "value": "POWERPC(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ab9f1a-b030-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620500740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620500740, "uuid": "e869a77b-ea89-4a3c-a7a7-c0a63a785bf3", "comment": "Malware payload", "value": "8f2dcb831cdb3a6d810cb1f198a9c863", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620500740, "uuid": "197cf6dc-6a3b-4be8-8ab8-9f11f9649b81", "comment": "Malware payload", "value": "15de6ea6057a17d60ff59a8accf9d9368b52fb0cd3daec22f5d4ec8a7468884e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620500740, "uuid": "60b3abc7-4906-4939-b0eb-02f0ed1c3c49", "comment": "Malware payload", "value": "210efbe7c17e2486d65be6be8d5cb9dd994ece8c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620500740, "uuid": "4dafe20a-9c23-4ecf-9e67-6034e6a9c360", "comment": "Malware payload", "value": "b5669f1c5a5fff9251086ba673ceb6458ee965fe3671479448ff7717748dd8cdceaa82c9cd6b94ea12bcb6e063887f3e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620500740, "uuid": "5707eaf4-2fa3-48fe-8a8f-fbc863bc6a44", "value": "03F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620500740, "uuid": "30134cf6-929b-4a6a-96fc-7196eccb1ab1", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620500740, "uuid": "1d9f1fab-181d-4641-9ad5-cac273f5a93c", "value": "3072:liFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:OeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620500740, "uuid": "a746a6ee-dc76-49ab-9d47-ed29668f38ed", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620500740, "uuid": "2aedad62-cb79-45d5-a1a1-426176253476", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620500740, "uuid": "30c5a147-a350-4179-9139-0828b8e0e579", "value": "8f2dcb83_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd265f1-b004-11eb-abe1-42010a9c0039", "comment": "Malware payload (YoungLotus)", "timestamp": 1620482022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482022, "uuid": "d5945e52-8d23-4e29-b105-9e791bb3398c", "comment": "Malware payload (YoungLotus)", "value": "c3d1bb04a79f3e2164a0264316e9a94f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482022, "uuid": "ecde8388-8518-40e8-9c8c-2882fa503d97", "comment": "Malware payload (YoungLotus)", "value": "17075832426b085743c2ba811690b525cf8d486da127edc030f28bb3e10e0734", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482022, "uuid": "4bdaa6d6-57b2-48a0-8966-9e1d4c678ffb", "comment": "Malware payload (YoungLotus)", "value": "3a76eeffded18d5f6089bf59c3e343f4cc356ed7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482022, "uuid": "2cfd41a1-2b3b-4039-891f-f97a27d96846", "comment": "Malware payload (YoungLotus)", "value": "e09aa7db54e8f9c269dc37786ea2ec2c722b444c10f99fd27dc30ae563bfa86da2bd8115d9772769cdb08ff4b2bf2aee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482022, "uuid": "8e3ad308-f0f9-4e02-8290-4efcd5300693", "value": "FAE3AF13A74046BEE1A3533C549F5739AAFF7C300A5EE467B3889A0A1CA51DBE314B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482022, "uuid": "058859a1-01f1-4d82-99f9-36bd878aaa65", "value": "b2eafe5d4b8c52d2ad598c3ccde39584", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482022, "uuid": "39dcbbb3-e00c-4422-bab8-5582b4afa318", "value": "3072:QSTRXHO5lCOvc4yrDLCNlXOtXazr9tTBfoaDtZ6fD:QS93O5lCOMrDuNlXO1aFtTBQaDtQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482022, "uuid": "01326fa7-b290-405f-b88b-6f02120a8b20", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482022, "uuid": "39dbb3e1-ba66-4545-b265-f4b837c2b39d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482022, "uuid": "382cc950-d9b2-444c-a13c-b98e782a3026", "value": "10000000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9752ffb1-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478926, "uuid": "8b50c882-b837-42f2-9de7-01d1b5591a9a", "comment": "Malware payload (Dridex)", "value": "20d7eee3d87f9ebaef88ca7ffcd9d194", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478926, "uuid": "9be30e85-406b-4642-a1c0-cd98897d62ba", "comment": "Malware payload (Dridex)", "value": "175d75ea942c0d882d5747bf6476633a25b3ad1455f9d098dded566271dfa675", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478926, "uuid": "5a582475-f442-4ac4-b107-2aea19e5fb52", "comment": "Malware payload (Dridex)", "value": "ab727c33888a82438a7162628ce4c2def15df2be", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478926, "uuid": "3ac37f88-3dfc-4ccd-935d-627b1d1b52d9", "comment": "Malware payload (Dridex)", "value": "99904044b4286f59968c32185e7294fb183d5674868a05cef9638a69cf54c5a39494deaeb54d3c9aea85959ef94891e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478926, "uuid": "b9a9f92a-824a-4c50-b81c-0c1d32a3bd53", "value": "E8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478926, "uuid": "c9fdd8d6-4367-4269-bce9-3be34882e819", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478926, "uuid": "9693c721-dd51-4dd6-a642-5a561413e1c9", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478926, "uuid": "684ceb93-b468-44b7-ac3d-a138c23116b6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478926, "uuid": "b3522cff-7331-4301-afbd-d94528ea5eec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478926, "uuid": "b071eaf3-23d6-4fa2-80e7-e2d6ce2cdb09", "value": "20d7eee3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510f682f-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457333, "uuid": "b5193619-d24f-4850-9b8b-9f8d46ebefaf", "comment": "Malware payload (Dridex)", "value": "fd093291bbf69be42c8671d5e25a2521", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457333, "uuid": "18f38141-6830-4604-b100-dc5477b54f97", "comment": "Malware payload (Dridex)", "value": "18404cc1cd00c57623169852380810135df46845735cc5315c44a95b47a147f8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457333, "uuid": "c5baadb8-5136-4db6-9a3e-ff4b783295ee", "comment": "Malware payload (Dridex)", "value": "41027ffd8e2c86dec4733b776bf8524e7e75a532", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457333, "uuid": "0e81692f-a7fa-41f1-8deb-12ba6a7dd348", "comment": "Malware payload (Dridex)", "value": "d31691ef04429c6dbf2d0f4cb645f2551b158e9d1fba92923926cdebac4cf9e8b43006413893e4a81f9a897941a08174", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457333, "uuid": "294f721f-0f70-4d7e-9220-c5e3cebb8ead", "value": "22F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457333, "uuid": "2ebc6221-16cc-459d-8e1e-b6ff38860a15", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457333, "uuid": "32873484-4d1b-47b5-b983-a237fd2309a2", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457333, "uuid": "de7ed344-9912-4aec-b88b-12a572a35e21", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457333, "uuid": "9e7176ad-f7cf-4f40-8e9c-7110e43b6d1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457333, "uuid": "ae4049be-da19-4391-ba31-db7b5a63e630", "value": "fd093291_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a1b463-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478901, "uuid": "0ece9145-67b0-445f-9e90-5bd8019ed072", "comment": "Malware payload (Dridex)", "value": "8c4079c531070f41badb4349143da3bc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478901, "uuid": "6984b82b-f7c2-4fe0-b73a-118fc0368c92", "comment": "Malware payload (Dridex)", "value": "1929b2f5e2c18a711471b11b540afbd46e331451c5c47c02180e5f36964c1deb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478901, "uuid": "7f1d45a0-c1b4-4caa-84a1-7c392ba2450d", "comment": "Malware payload (Dridex)", "value": "c057bfb0b821b75be28cea4cb73904959b6e072b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478901, "uuid": "7865f9b6-2c9d-419f-be58-2e248393cc9f", "comment": "Malware payload (Dridex)", "value": "969c7ec1ad357f5027ee86dff7907d236f88f24b68675c9c4fb92bb1d6842d5124d5c6a6887767c279354dcd4f37ceb8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478901, "uuid": "16ea0ea8-feb1-43f8-bd70-aba0986a1e49", "value": "5BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478901, "uuid": "64b2476c-b746-40ae-8f31-ca371dce17f4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478901, "uuid": "89fca62b-e83c-4f47-b4c4-40a6416f07d9", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478901, "uuid": "dbc57f76-d4ab-4a48-ae14-a1e37c1fcc24", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478901, "uuid": "5b3405a9-f4ca-4cdd-8070-ef29f9efd1c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478901, "uuid": "16a9acf2-dd1d-46dc-ba6c-01a5d8249c34", "value": "8c4079c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528d5a6f-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475375, "uuid": "e22aacac-6804-4e0c-9be5-28f807782ff1", "comment": "Malware payload (Mirai)", "value": "68ae40d0387accbf96e584156818b1db", "object_relation": "md5", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475375, "uuid": "90a155a8-cc11-4b82-82be-81d8561713a8", "comment": "Malware payload (Mirai)", "value": "199d2fc99d129daa54c35c39552cac548159646fa68028d276526e1500d90b87", "object_relation": "sha256", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475375, "uuid": "2501f94a-b784-4d33-8c9f-2caccc862d1a", "comment": "Malware payload (Mirai)", "value": "297e6bcca04360c11fa598b57e5983f742afc1f2", "object_relation": "sha1", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475375, "uuid": "561a0aee-902e-4094-8647-26b1a7e33ab1", "comment": "Malware payload (Mirai)", "value": "2fa8bb9d4258c0e1c0b300b85bf18d70fd7b14ec320882e8f2444e59a7d922da152f9efe8fc4de02cd9638f5ddf2b6ab", "object_relation": "sha3-384", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475375, "uuid": "d139d381-d5ba-4cf1-a937-315a47a4897f", "value": "3954B4797B21BF2ED7B892310BF62FB0D31510C636A1D351E27CDA14AEB124C589E7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475375, "uuid": "44f998b1-bfd7-4504-87d3-7f3d74d6a11e", "value": "3072:rDY4uW9wRS4LaihiJcM7QJWbuP7cNkzGkXR+jLpZ/vwARqtaZPCEr37yqK1bPC0R:ThZAuQePCEr3mNDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475375, "uuid": "c065f287-d56c-4f0f-af77-ff7e9492ec82", "value": 289669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475375, "uuid": "714b15d1-db38-4e1d-838b-c0b747fdbfac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475375, "uuid": "744a2e73-33d7-4768-a1a3-2eecc83ae9b4", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91dc3c9-b01f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493693, "uuid": "9b3a2f03-8e99-4a75-9e64-c4ad2617571e", "comment": "Malware payload (Dridex)", "value": "a477d9c51b42c8571a86aa129677df2f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493693, "uuid": "bdfb5b62-c3c6-4217-b13e-42e351842837", "comment": "Malware payload (Dridex)", "value": "19ff5f5f823389fe3d41c8725090518f0a2fab87539aaefe9fc61cbf468ef901", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493693, "uuid": "0c405dd9-fe3f-424f-a69d-adddebe9f270", "comment": "Malware payload (Dridex)", "value": "d9e134675714ad1e86ab5c88bf5e54926be00289", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493693, "uuid": "d657b1c2-458f-473a-b690-3e65a6870ed1", "comment": "Malware payload (Dridex)", "value": "6a86fdb2d78bd30e9f4e62899b118c14502ef093fc2abbad28aaa67e1dc27514b03ac80891b42a6febe104d83c718b3f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493693, "uuid": "83869711-f58f-407f-8d60-4fc0103e339d", "value": "D4F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493693, "uuid": "c7ef8267-ebbd-485d-be66-10213b83c35b", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493693, "uuid": "b575eb08-cec8-43ee-8453-f327527f56d3", "value": "3072:ce45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:Z4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493693, "uuid": "cc52c90b-88e7-44e9-8af3-7a0f3fba457d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493693, "uuid": "563bf6cd-454f-4544-8ea3-c340544872c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493693, "uuid": "d2238fcb-2ee1-4119-abba-9e86d1a7e3a0", "value": "a477d9c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3e8001-afdb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464466, "uuid": "f7ea11fd-8fd3-455f-bc5e-65d8390ba4eb", "comment": "Malware payload (Dridex)", "value": "be5822a20cf96a755e4ebc97fdb7c8ec", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464466, "uuid": "0129a906-b26c-4145-b7b0-f9bfc10fcbb8", "comment": "Malware payload (Dridex)", "value": "1a077dba563e641f03e47e0ba8286eb2eb0ccd4ad9030485367b2ffae98c5c88", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464466, "uuid": "6c25078b-cc3c-4e76-967a-93426d05c934", "comment": "Malware payload (Dridex)", "value": "b9809c50f315e527427d146676edf5fdb9aa6fc7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464466, "uuid": "7d380896-d770-4369-aa8c-8ff748c6628a", "comment": "Malware payload (Dridex)", "value": "c31ccbbe761a6e50e28651a372b8e4a064fa32db60a906ef89e79c96c8741795dc7d5077c7a01e606178986e5f66bdda", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464466, "uuid": "64dabf1f-06a9-4bb4-951e-0736f66e6e42", "value": "4FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464466, "uuid": "aa149cdd-2363-479b-95c0-166f9b9e5dfe", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464466, "uuid": "848d1821-91c6-4b08-92d7-06e66eb275b8", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464466, "uuid": "2fa24bea-0e83-41e1-9d41-59e853c1c5eb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464466, "uuid": "2aa9c62c-03a0-4291-804c-4fa683bbcc77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464466, "uuid": "5e7d00b6-b6de-49df-a8ee-2ac62a1d6449", "value": "be5822a2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39db7b9-afb4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620447620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447620, "uuid": "1dbe0831-a49e-49bc-a545-1272a980d996", "comment": "Malware payload (Mirai)", "value": "af33c66991865aecee0a2b19da9375af", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447620, "uuid": "ef392456-72e8-462c-9af8-9ed6cfb6e267", "comment": "Malware payload (Mirai)", "value": "1ae8755d7ebfb696511307d32f20df11a351ce806e081d99d6ad6b21e34d5c53", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447620, "uuid": "cb56f148-1178-427e-b859-e73c0f191e04", "comment": "Malware payload (Mirai)", "value": "c6cd68ac310af5443c19ba6f26031e65f87ec6f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447620, "uuid": "16b4af20-6a8f-4b3d-9a32-4787dca45534", "comment": "Malware payload (Mirai)", "value": "55616e1a03eee1891d85a8a82acb9a1092247d1729bcffaf00b62b2b19e0a39064a69af7b190b163be720e16b9ea5bbe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447620, "uuid": "e84232af-8f4f-4ba6-8273-593169fef01c", "value": "42E2F1E3D39355E1E1D90CFB4AB0F54C358A1778D3DA36613A00B878E6C95428DB58EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447620, "uuid": "d346b3c5-c93f-4607-991b-76e09e0579a8", "value": "768:Va51sjfqvcfjeW0DECZew359d+1TKE2KKMg87s+d3UiF:VmxvW0DZo1t2fV87j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620447620, "uuid": "062bf8f3-c227-4ed3-b56c-fc68d6602c99", "value": 32656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620447620, "uuid": "ee383d9c-76be-4477-b30d-21a4e04dc414", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447620, "uuid": "8455302d-8e72-4e6c-a181-98a2a2636705", "value": "ARMV5L(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42926e21-afa1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620439270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439270, "uuid": "88eeb507-bbcd-462f-b788-ff4c93b717b4", "comment": "Malware payload (Dridex)", "value": "d483e8614ed925ba4cc8631459a9ff45", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439270, "uuid": "23de381d-faa0-41d2-b84c-e5c9bfdd9dc1", "comment": "Malware payload (Dridex)", "value": "1ba195825ac90eba409ae9296e47752549f7da984d03be351e0f4394727fa0a1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439270, "uuid": "9b55775e-a151-46f6-b3dc-be15d483815c", "comment": "Malware payload (Dridex)", "value": "a00b9162d81a969009dfbd9450fdeeb8a03188b4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439270, "uuid": "6b3c4ca3-6cba-41a8-b34a-b1644e7c827c", "comment": "Malware payload (Dridex)", "value": "25dbb21bb1f23fd695a72c64fd24c4c57fd7a0eeda24e5d703692d56489d3b7423993e0761e3df09ec492edab95bfe8b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439270, "uuid": "0f49e118-07a5-42a2-a26e-df9796d0e269", "value": "1CF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439270, "uuid": "3778b7d2-50d6-4c79-8138-cdc66734f704", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439270, "uuid": "06203a6e-f2b3-4082-bd8e-c62ecdae44e5", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620439270, "uuid": "944ea675-ced3-4887-bd9d-fffa24fd5bbf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620439270, "uuid": "b3f60861-d0c2-42c3-b0d6-0286e47b2467", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439270, "uuid": "3fcefeba-76f5-4b60-a89e-696f52df4929", "value": "d483e861_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1f9e19-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435686, "uuid": "dfd4fadb-c46f-4592-9ffb-b1ab4ba3f229", "comment": "Malware payload (Dridex)", "value": "28b51465da6395beaaec6e5ad23e822a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435686, "uuid": "5a4811ba-94c1-4eb7-9ce2-e601a0b0a345", "comment": "Malware payload (Dridex)", "value": "1c018b0e90c5f00c2c6f993c2276836dc47102174aa1f3824d0dafe069dede18", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435686, "uuid": "80ff073f-bc0d-44c2-a534-a7873af33455", "comment": "Malware payload (Dridex)", "value": "10cc5d62aec7efe332164d89c4b65bf345dc11ce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435686, "uuid": "8a313889-6d51-4868-a371-4fb9f01dc4c4", "comment": "Malware payload (Dridex)", "value": "2b8418cc1eeba9c8d7a0ad37fbacc97211beb7b9364610ce48f9f7dfa5fdf1157a7d712dbe6715915f7741a741156eea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435686, "uuid": "164cc4a9-87b6-44d2-866e-999ee9bad77b", "value": "E4F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435686, "uuid": "ad50de02-14f2-4bf4-8fb9-14f820b992d8", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435686, "uuid": "cf26ffa9-6a9f-4488-b13e-7ca5e68212d9", "value": "3072:3uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:30czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435686, "uuid": "d16fd919-7f17-49ab-9160-18bb7583e7f5", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435686, "uuid": "90563c4a-bf35-42fd-9d1d-607d2944a3d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435686, "uuid": "833f26b5-d7b7-46e5-a871-835ab5ca98a7", "value": "28b51465_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e598691-afa1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620439263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439263, "uuid": "453de831-df42-4d42-9ecf-ae1843dba9bf", "comment": "Malware payload (Dridex)", "value": "17cdfd0313f83a56bded27e974930883", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439263, "uuid": "7f428c8b-d4ec-4a58-97d6-6593083177bf", "comment": "Malware payload (Dridex)", "value": "1c31041e4a5f51625c06b59aa0ab0d91afce3f42b6863b4ae13d555ca9191a55", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439263, "uuid": "2129d4cf-423a-48e3-b987-d1ae19b3a281", "comment": "Malware payload (Dridex)", "value": "f79078bf5c4be62995182f5e8b0daf327dabeabd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439263, "uuid": "68ab5237-07f3-4916-9c8e-dadbf789520d", "comment": "Malware payload (Dridex)", "value": "002ef856bb7a2ccf95e8bafd2b1274736972a36566ed668d3ee78b8c45e289ff6b31b8b1f03d458adb16047dbbbc521b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439263, "uuid": "fdf8eb2e-18cd-49be-b673-813b4e3f3f2f", "value": "01F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439263, "uuid": "b99e3c17-066b-44b3-a811-5d5c29b3ac92", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439263, "uuid": "9cc160a8-7e31-4410-b935-ff8dddf77481", "value": "3072:flpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:flo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620439263, "uuid": "08c6b3d6-cbd6-4075-85eb-967bb7cdaa21", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620439263, "uuid": "4505c46d-a790-4031-9a49-ed63c8f8b6f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439263, "uuid": "98197aba-f741-439a-bfac-5bf01b44aab9", "value": "17cdfd03_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5570f81a-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620475380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "04aeb569-c5de-4153-969e-1cff71e0796b", "comment": "Malware payload", "value": "89d115df09d3129de9a634a523d62b9e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "992ea883-4398-4836-b868-f2cd058598e3", "comment": "Malware payload", "value": "1cb26d3b920b3d73b099b9783711433d1a526dcb94cfeac366849b5a95f3d93b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "cc410f25-9aa6-45f4-acee-348ff438e411", "comment": "Malware payload", "value": "3b4fbd4b989243ebecf2845cf6ada6f1e6078ef6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "0fa43851-b7b5-46fb-bd33-d2be5b6bb212", "comment": "Malware payload", "value": "8dec38bd99ba142dc01bc0c33c2538b4478a1e278e302d7195e16a81e5ccfada61ce4f2fe2b18c05a5465c3a999fcb84", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "22732a46-b279-4860-9840-930b7a585fbe", "value": "D9933B426E1C1D23D3560B702D2F23F593B561E009A596462E1BDF868133B7369BBFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "391b5aa9-1040-4b3f-ac64-a7662269d692", "value": "1536:iOnjHdcwxk2Kmtvqm4DOagpKTblpiG2G72UAIb0lpHvehvDfEbTAwc:i0QGA/PC+b0fHEvSTAwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475380, "uuid": "00cd3555-ab7f-4b90-84ce-756932f41ab0", "value": 92168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475380, "uuid": "599d1d3c-60a1-40ff-9aaf-fb97111cc63f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "da6bc317-a035-4195-9359-1051ce68fa17", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ccbb37b-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460896, "uuid": "58c3148e-4efc-4fee-acf7-5d99a8e5aabc", "comment": "Malware payload (Dridex)", "value": "1a23a3c5c80243eab586fbf534410697", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460896, "uuid": "b815c2ed-15d7-496d-ba52-919bfa29b791", "comment": "Malware payload (Dridex)", "value": "1d154acfba789a002be2b2f25441e82d4df219a3b19dcb5a651c68b2da4fd0ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460896, "uuid": "e9202804-b6cf-4598-ae18-e7d6c859b8a6", "comment": "Malware payload (Dridex)", "value": "820244f296280eea7904c184c2827d3eae467502", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460896, "uuid": "5792e0b3-558f-43e1-b5a7-14254d0447af", "comment": "Malware payload (Dridex)", "value": "01cf473630aaed0d8f855bfce64d84c0d4b27b03316f7d6d371fa764c0c9cb9b46f33e9eae6db5324afd57ce7e6e15fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460896, "uuid": "f36c52da-7544-41ce-bd6b-12eebd137e2b", "value": "FCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460896, "uuid": "74a4c833-2dc9-4bc5-99f3-700df3d57dd7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460896, "uuid": "2820794c-3368-44b1-920e-36e35bc17feb", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460896, "uuid": "d68ce15d-ce44-4ab5-8569-dd5d48ddbc27", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460896, "uuid": "d5cf9a9e-41f7-4e22-9fa6-560c3af232e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460896, "uuid": "0f0fb371-403b-4ee1-9b3c-b97f2ef8c0de", "value": "1a23a3c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e782ade0-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435681, "uuid": "331a2a50-d056-49b0-8e71-7daa9a8de2f1", "comment": "Malware payload (Dridex)", "value": "952c6aa0d009a34190f3f925ad360c93", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435681, "uuid": "dce19c25-752e-4eb8-b73d-2b3eaf28c2b2", "comment": "Malware payload (Dridex)", "value": "1d4b969e3740cacfe49ece8e8a621226f69cc851ae277c61b6b7318a684dfbd0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435681, "uuid": "c5cf55b4-8634-4de3-95ba-86cd8858252a", "comment": "Malware payload (Dridex)", "value": "302d894c27bff9cd056bba2a0e28c7813cc6e728", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435681, "uuid": "8f02a042-49df-4f07-abbe-72fc2b17864d", "comment": "Malware payload (Dridex)", "value": "b33dbf238bf5a59eae65e7c48fcdf0450f28644d87b4d95677f178d0aac941c8d7248590db382e11f6afe3abfe4aa182", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435681, "uuid": "88eecd8e-8811-4e03-b14c-cd661ec1175f", "value": "92F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435681, "uuid": "09435965-f504-464e-a7d9-7b9b00b3eebd", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435681, "uuid": "4f2dc8c0-c0c0-41f8-8993-7bac7b860327", "value": "3072:8WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:842IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435681, "uuid": "709c3869-6e50-4a6a-97e8-80dff4f6c9ff", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435681, "uuid": "50791505-f343-4657-a090-24de851e0fb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435681, "uuid": "93ccae13-d1ca-4103-84f0-41e20176d27b", "value": "952c6aa0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f64b2b6-afca-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620456874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456874, "uuid": "993527f7-b9cf-4bfa-a3f5-d37748d9d7f8", "comment": "Malware payload (TrickBot)", "value": "08875dd32afe0beff296ebcb7639c2e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456874, "uuid": "9fb63647-4945-4bac-875e-85debab8be29", "comment": "Malware payload (TrickBot)", "value": "1df7adb79eb1757f7c54e86369c72a38b24ec25a608d5281b289d5e018e81757", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456874, "uuid": "493ec182-2662-4cc6-afd3-e9e515594fb7", "comment": "Malware payload (TrickBot)", "value": "ad921eb9313327ad90d6d023134fe30a82930520", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456874, "uuid": "018d431b-49bf-4a91-b62c-7245dbefb5a3", "comment": "Malware payload (TrickBot)", "value": "090b7cbf785958c0a8f2e4537cbe15d97b3cf4ca52334d3620471d0ba412e6584c8c66140cd47bd9e44d2b7199bb0a1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456874, "uuid": "371b2013-777c-49cb-8e24-89d7da9ea675", "value": "F8F4BE02B2D1C177FAF202714FEAAEF7EAF5F9114A295447F3D62B0D19719434A36A20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456874, "uuid": "13ba9f55-ba54-4581-b9f1-3940306dec77", "value": "a854f0696e579de7373340a712e95c97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456874, "uuid": "3843ad26-0a48-460f-940e-4a80ee300971", "value": "12288:bZfAStuSnRmDuGQ9bNfvzF04ueQlzxE30wIpgfCORMxVB:h5RmKNfbC4ueQhuEZifCqMxVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456874, "uuid": "6165b995-3365-45c7-822d-09b37c731373", "value": 757828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456874, "uuid": "adc8829c-c8fb-4699-9d3c-94d28352653b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456874, "uuid": "e2c88cb2-d5df-4dd1-915f-21b289f50ab0", "value": "08875dd32afe0beff296ebcb7639c2e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd4a07d-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489698, "uuid": "34abe8dc-8cf0-4842-ab94-c2d6a3740d23", "comment": "Malware payload (Dridex)", "value": "b1f3f6740ee09208458e0b58a5df553e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489698, "uuid": "ed297cf1-ef56-46bd-83cf-35de26c52f25", "comment": "Malware payload (Dridex)", "value": "1e12c698ca4a6dc039a15c7b38edd2bb8a1bdfbebf5b19fd2e3133e301d66f4c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489698, "uuid": "020673b6-d236-4013-8bb4-0665d78bdef6", "comment": "Malware payload (Dridex)", "value": "1b90615dc42b7ff7d5ac30b9ce3e3e98629ff39e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489698, "uuid": "100c36bd-b4ff-469f-972f-c017dab81481", "comment": "Malware payload (Dridex)", "value": "4ee6e225663964f52283669f5fa9dcddf3db861cbb518f3a7b85c622e566af31c40a1c88f5de507c40ed086e887318ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489698, "uuid": "5fce7495-9140-439f-bb61-c6088458afc3", "value": "8FF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489698, "uuid": "d24c06ec-5392-46fc-8997-9130e0e6d41e", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489698, "uuid": "9ed85d8a-b84c-4873-b4a1-14dd79790581", "value": "3072:ciFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:/eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489698, "uuid": "9fcdc20e-d9a1-4b94-9d23-ac20414a5013", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489698, "uuid": "3d9ca4c8-0235-481b-aaab-23dab50a08d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489698, "uuid": "9041536f-6813-48e3-9075-e8e6d4543e2a", "value": "b1f3f674_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dfcf8be-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432095, "uuid": "dca33a40-ebe1-4d6e-b7d9-7b0a2003365a", "comment": "Malware payload (Dridex)", "value": "fc551871c0cc11bc1d673a9849ac7496", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432095, "uuid": "3b8c5bad-2f20-4637-ac2d-f785ab35aa06", "comment": "Malware payload (Dridex)", "value": "1e5dab8c1b895ff39c7295d0b64630c9a8a0253bbb54c41b4a080f92dda25abb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432095, "uuid": "0a00e80a-6c29-43ed-bb9c-4a234d729944", "comment": "Malware payload (Dridex)", "value": "f64095cd7604f6409da2e1cf85c972280a7edc36", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432095, "uuid": "54a6013f-ca3c-457d-adfb-8b9d125e2840", "comment": "Malware payload (Dridex)", "value": "57053fbe72b6c181339386c4890802a6c2c609bbfdbb6d546fb3587ed7c09a4ff2ef76dd48e8334598cef579ff0ac428", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432095, "uuid": "805866c0-54a7-4346-a8ab-91fb07c978d6", "value": "EFF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432095, "uuid": "767255d2-d007-4cc7-b6b5-eb52128e5f33", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432095, "uuid": "15e766ec-c386-4f4f-a0e7-9e917423cedc", "value": "3072:MA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:M3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432095, "uuid": "bdb3d42f-1adc-4d50-ad9d-2aa34f06123e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432095, "uuid": "fad0e2fc-c3a1-4124-90ce-15d803b2d060", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432095, "uuid": "ba3004cf-cb33-45ee-95cb-d291962ff268", "value": "fc551871_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a25d5e7-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442853, "uuid": "d8b4d027-8a03-49bc-b434-bd6f39a0eb59", "comment": "Malware payload (Dridex)", "value": "39dc063aeb9be2a4ef8a63f4caf29d01", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442853, "uuid": "58c64440-062f-4273-9c3e-ef18c12a28a8", "comment": "Malware payload (Dridex)", "value": "1ea07636b2f679883d077b81be57b4028c0e7c89c57deb0361cf7c5255cd2af4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442853, "uuid": "6547b6e6-1fcc-4ed7-9714-b15969307e40", "comment": "Malware payload (Dridex)", "value": "327e679fcdcd6a138d840710ad924830a91ebf68", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442853, "uuid": "20361f1c-3d76-46c7-a37d-34e7bc9ef651", "comment": "Malware payload (Dridex)", "value": "a17209fcc093ff740585097f83f405192de69a117c1d6d767a206ba5003e7dea33e6806e5c08ce3ff7cd75e85a7adbd9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442853, "uuid": "e00278d7-71a6-47ae-b90d-9a6922a538f7", "value": "E9F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442853, "uuid": "29e13dc3-8a1e-4c3b-9bb3-9f6cff37e9eb", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442853, "uuid": "42cca24e-7d54-4f12-8de9-5537ad4ec748", "value": "3072:9WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:942IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442853, "uuid": "85995991-3b04-477a-8cbe-541f128a5b1e", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442853, "uuid": "935fd3fa-ac0d-4633-a36a-86a449469a78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442853, "uuid": "9c83baad-c0d2-4999-b8bf-776514d84510", "value": "39dc063a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a6574f-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471667, "uuid": "bee214a0-32ea-462c-918f-0b19140f3893", "comment": "Malware payload (Dridex)", "value": "c30d3ecf7044c2d5431f08f06c0432be", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471667, "uuid": "a554d6bf-8ced-4a55-a497-cdc04546c068", "comment": "Malware payload (Dridex)", "value": "1f2c22c1d14301a5eba0fd1b8f5b8808eb254684877b434c3a72e713e45e34d4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471667, "uuid": "b6fdb7d9-3daa-4824-b44a-f55b903a9452", "comment": "Malware payload (Dridex)", "value": "04302612b2c1a16011db67f4cafbb2c4fdd9bc82", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471667, "uuid": "de6402e6-f23a-4372-add4-2ca962b66c80", "comment": "Malware payload (Dridex)", "value": "43c82c1fc7d62d04056f6831876481f10314024473b50dbed2b13396f19f180d9927c56dd2a88cc114d17125adf3fc13", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471667, "uuid": "77a19bd9-7cef-4ad9-b193-f6581fd78338", "value": "1CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471667, "uuid": "9ee05354-f894-4ae5-87c2-65ab7b211fae", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471667, "uuid": "4c33efa9-2f73-4711-aa6a-c5721f0ab9ce", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471667, "uuid": "0f9c3e72-f02d-4f59-b705-61500c9898f8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471667, "uuid": "70254fa4-6cae-4e22-8b98-9231be6899de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471667, "uuid": "6f85e76e-966b-45ac-9980-7e3d91e8e3c3", "value": "c30d3ecf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e7dca2-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486062, "uuid": "8429dddd-123d-48c5-826d-ef981aa03628", "comment": "Malware payload (Dridex)", "value": "386ef1f2f9caa6b03e0191a41a384b15", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486062, "uuid": "a447ea2a-3122-4770-8e1f-2247d4186ad8", "comment": "Malware payload (Dridex)", "value": "1f5ba53f8a7d598c09af5f8451dd7d3e6dd139e4be75790ec023a4d4491f1fa1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486062, "uuid": "d5826697-c3f2-4110-969c-4721fbdaa3ec", "comment": "Malware payload (Dridex)", "value": "9596c95b043ea1ed9332886ebbfe2a5760d82a79", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486062, "uuid": "3a7905ff-0627-45e2-aebe-104abd37b950", "comment": "Malware payload (Dridex)", "value": "7fb414ac52f42d9ae7e339f884b4581f656750dea32b6d1cf89c845d3cbd7c86682a3686b09bc2adcfbc7d12b03bc0cd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486062, "uuid": "602eef33-05c1-435b-b181-5f3f9bc4b3f1", "value": "72F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486062, "uuid": "276a83d1-c4fc-4aaf-b509-fce7f855947a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486062, "uuid": "139cbd34-6007-4f65-beef-c0777f88426c", "value": "3072:+lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:+lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486062, "uuid": "9a3aafbb-8e19-404c-a9d1-b6ac5d36663b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486062, "uuid": "73cad607-3abe-4f27-8a86-b7d4596918ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486062, "uuid": "3b7001e5-c17e-4ea0-8cf5-da086de50196", "value": "386ef1f2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407b1281-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486082, "uuid": "bfb235dc-1481-48d2-86d9-fe9d156f238e", "comment": "Malware payload (Dridex)", "value": "be7f9b282a57196a01f8b0e803e3ac97", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486082, "uuid": "e3d26211-3677-4a0a-80ee-7d41cc7acc59", "comment": "Malware payload (Dridex)", "value": "1f7bf576275181447d0873379f6a3519fe5d8e3b44d1e2f939d8703be087dfd0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486082, "uuid": "2752c618-c8f5-4a65-b316-4f050330e3d9", "comment": "Malware payload (Dridex)", "value": "2d91fca3de2c68166699a71b39d80fa276a34a02", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486082, "uuid": "9e263fb2-d727-45c4-904e-51c763f89f89", "comment": "Malware payload (Dridex)", "value": "17dc8e8bf642f6bf088eb06980f1270dd29b702e0f527e08d10e567e46f30aff3438a1e724101c1573136a337d8eacc7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486082, "uuid": "5ecc611d-ce17-4e3a-976f-a2eb8a45e52b", "value": "33F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486082, "uuid": "2d392741-cdee-4e43-91ea-801b5f541cfa", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486082, "uuid": "8d5f6bc1-1c26-4c72-84dd-9b05e0649301", "value": "3072:1lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:1lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486082, "uuid": "7a3f21ba-6fe0-4f8c-a2e7-ae1045b39c99", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486082, "uuid": "eb35100f-e716-4905-93e6-37e47641a8d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486082, "uuid": "1b056df6-9920-4f87-b13a-b5790224de12", "value": "be7f9b28_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b258ed46-afca-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620457067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457067, "uuid": "a1034678-b782-442d-b17a-7c5635530032", "comment": "Malware payload", "value": "0020a8386fd7261a45f29b3a9d14925e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457067, "uuid": "38f4699f-92f8-427d-8981-9de300e30b5b", "comment": "Malware payload", "value": "2011994069be3b7b49d4ea7bb3464e91be9a5c12cdcbfd9cb8bc7b13d831e5b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457067, "uuid": "9a67edb0-9b71-4b08-aae9-1550bfa59f2e", "comment": "Malware payload", "value": "be05a9ffa0e8c8486411795162c1f5dd96788a46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457067, "uuid": "00050fe2-3f39-4390-a375-4af2ecab1518", "comment": "Malware payload", "value": "0fec71f7dc592ea52138628c78d2a6a34a91f04922b67df6a0465c2a8d1807ffe63fb7d99b4d8ce1b0043cbadabc67c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457067, "uuid": "12764619-bbae-4b71-9fb0-8c66522337e0", "value": "66F3AE1124C5C0B6E16278BA819AC7B14EAE786527269ECF5FC94CB41F24BD2DB3470F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457067, "uuid": "d1186280-5591-41dd-a291-2f2c97150d8e", "value": "3072:ETX+3BUevPAysBYNJigb0t+GCvQeWmlxRUxLu9oU9YhbzYDWp0q:8xyfKCoNmFULYWQhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457067, "uuid": "3c3df297-1e32-4f9f-a65e-4cd7efe855ad", "value": 168413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457067, "uuid": "b2b3e820-2d38-441c-b807-ba7ba65f0270", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457067, "uuid": "f0f6d738-840e-43c3-8092-24f2842c16ba", "value": "0020a8386fd7261a45f29b3a9d14925e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627bc3b3-afb5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620447914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447914, "uuid": "fef7792e-00f3-4e97-98fb-07d4274e2919", "comment": "Malware payload (Mirai)", "value": "48a5e8bb7d74b57e1d03b76c78cd1d7b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447914, "uuid": "89f8e1a5-fbc3-4386-be71-81f283730551", "comment": "Malware payload (Mirai)", "value": "201e4398487008a7bd675e69a3cb7bbccc3042562111c3caeff0a76027453903", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447914, "uuid": "a74345ec-e1d9-4be3-9697-aa36e406881b", "comment": "Malware payload (Mirai)", "value": "ce36a9e66dc0479590cc852d93feeb20dd60b1ff", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447914, "uuid": "8f151175-8f73-432a-8a0e-b68f913932d4", "comment": "Malware payload (Mirai)", "value": "3767095862d0c83d898883b6fe78d58bd3b69b3a0a166640fdf99c8c62e1ce39d828fe3a330084ee6876fc70ac1da0b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447914, "uuid": "599cf65c-229e-49f1-bef7-d7f97c20a4da", "value": "6EE2E037E2D50A94C35E61371E0D726E192CF11969E852FAFFF834A23893F64752C222", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447914, "uuid": "4b6003e4-73b3-45ca-a538-7c2a5f0b9d22", "value": "768:OIp/7tBdf4UhSsBJpKvK95Yj3kV6VqbQd1iUaKgBKTuowdZ1fnbcuyD7Uryqs:O+j7hSG3gjEB3csKYdLfnouy8mqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620447914, "uuid": "d74413c5-50ef-4f63-a5f6-3bbca6187279", "value": 33304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620447914, "uuid": "a26b0080-4229-40de-abb0-7cd84b165586", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447914, "uuid": "09c3d782-0c10-43eb-9661-d7f754ee50f0", "value": "I586(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154ef82c-b02e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620499753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620499753, "uuid": "47cb6ac4-f2c4-4896-afea-057cd38e1b41", "comment": "Malware payload", "value": "d2825285fc96f007576ac8c3d498a900", "object_relation": "md5", "Tag": [ { "name": "batch", "colour": "#5941FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620499753, "uuid": "799d8af6-c296-4314-8b53-d7a1a3ee48c4", "comment": "Malware payload", "value": "2075cb4e20cc0d4d0ca7bb2442e71557891d1766849e90d6b28227572c7323fd", "object_relation": "sha256", "Tag": [ { "name": "batch", "colour": "#5941FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620499753, "uuid": "e28e54b8-529f-4daa-b579-40e58d55ffc1", "comment": "Malware payload", "value": "768677149d31a9d6373d278e375dd8f81596e1eb", "object_relation": "sha1", "Tag": [ { "name": "batch", "colour": "#5941FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620499753, "uuid": "89f4d8d9-47a9-40a7-bf7a-90a555277b95", "comment": "Malware payload", "value": "d2e237eb6ea285fea02a37b82bc6b19ce131e931ae8f8d2caad160ddbe626458b69dc1e15e84b4f042f5b5207a99d7de", "object_relation": "sha3-384", "Tag": [ { "name": "batch", "colour": "#5941FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620499753, "uuid": "d5b70b79-8ffe-46d4-915c-44c67112d2a4", "value": "7411907AEB06933748726E1852D7354FF61DA22CC1892E407845A89B3FA3E476A180F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620499753, "uuid": "199f2682-f0a3-4e61-b34d-495bd04d55bc", "value": "24:ZGqqCz+hRVtoz6GsYVTjAtOhAqVyOSHLqVAhfvyqJ9h744:ZGqqc+zu6GsjtIVyN+VAhSqJ3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620499753, "uuid": "b03ce22c-217d-46c3-9066-9f23caf8e963", "value": 1047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620499753, "uuid": "8fc3344b-3511-4744-af4f-4eb0d4f40a0b", "value": "text/x-msdos-batch", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620499753, "uuid": "d07592cc-afff-4fd8-b8aa-9266843630d7", "value": "trollware.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358f6b72-afa1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620439248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439248, "uuid": "b61b87e3-b94c-41d7-8591-f3a86dae47f9", "comment": "Malware payload (Dridex)", "value": "783e585cc71a8aea5da7702f1256a459", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439248, "uuid": "dbff7569-673c-401e-95b4-24f7fb47911d", "comment": "Malware payload (Dridex)", "value": "20873cdb9a1c16452fe0950420ee5d3ae40a65e099938c0ca0f66b66b29decfd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439248, "uuid": "d588f54f-5bff-46ed-993b-407a9eafced4", "comment": "Malware payload (Dridex)", "value": "e7abe4cb12ebd2bab60f59fb97f8a749346b75fa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439248, "uuid": "ad396ba1-8b01-44bc-b642-741b43d4ec24", "comment": "Malware payload (Dridex)", "value": "e281b7578be26738f846df8780605b7b93c550d5166323016dfec1f6b42de93833f866153043256c18827340e3667de5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439248, "uuid": "03001e31-7097-481e-b548-23c1d8060d89", "value": "DCF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439248, "uuid": "99f1bff3-81ed-410e-aff4-882fda44d089", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439248, "uuid": "c961c09c-e167-4293-8e94-59903d6f941d", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620439248, "uuid": "089c009d-15b3-4135-8f23-cd415e86acda", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620439248, "uuid": "9cda0cd9-e65a-4cd2-97f8-17e425a74af1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439248, "uuid": "58bc1b81-399b-4859-bc6b-2009384702a5", "value": "783e585c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f43ad92-afd7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620462457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462457, "uuid": "657bdf2d-ad1d-4914-9148-f1936a5ea8be", "comment": "Malware payload (AgentTesla)", "value": "ead14b875276579dd31b33aaaae8af73", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462457, "uuid": "e1700291-059d-4570-a40a-cd5c25aa293f", "comment": "Malware payload (AgentTesla)", "value": "210dd3fe347cc8ba8d15a83fd9803f45d85bf7d9eaabad63162eda9c01451b21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462457, "uuid": "215eacb6-fc47-443c-a39b-0ded73fc5f1b", "comment": "Malware payload (AgentTesla)", "value": "c6ae1c13e56791653598fb6f97b4218be2c9ce1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462457, "uuid": "334abe55-20ae-4a00-9879-fd9be46901c5", "comment": "Malware payload (AgentTesla)", "value": "f5f3e9ee47d4fc4e283b424e7f729b9e1e7374e9710966bc3a1eafb1f8c1fffe48d3ba1c9f334cefa5036addab166e10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462457, "uuid": "9fa6ba54-5d82-462b-87e5-cb6c7b14ff38", "value": "7D157DAC750465F2E35B1C37A3CF4C1242251674693FA90F5B6063BF5A93E233A39AC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462457, "uuid": "8dbb2141-b10e-43ca-8ed1-db5d96ef9c78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462457, "uuid": "4763ee15-252e-46f7-b871-931cf8ed2cd8", "value": "12288:efPnoLLoS60/K7yh01PUWIFazzIoWd+cmBTSKS3rz6ChPmCnOkkKXYFuj:woLAhUvmIoWoO3rzvLO5SIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620462457, "uuid": "4e14becc-b345-4336-aebe-05f0cc816e42", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620462457, "uuid": "1e2a2e26-8ebe-4eb5-add4-d3423b4d6763", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462457, "uuid": "748a0002-8926-4df9-bd3e-ee3be198472d", "value": "bank slip pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4456b8e1-b020-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493819, "uuid": "054ca56e-8279-4af4-8d29-9b4b51a20115", "comment": "Malware payload (Dridex)", "value": "379354ae4ae06c50dc27c0991ac90438", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493819, "uuid": "b2200efe-924f-48da-abf8-1e46e9c34659", "comment": "Malware payload (Dridex)", "value": "215dffa209c5f917a1932aa506dffb7d547dbcb0613adeff6bd3288c66b1d1b3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493819, "uuid": "45e06662-0387-4f62-babd-c12c63a922b3", "comment": "Malware payload (Dridex)", "value": "3e4097201e8039e0f79970e6a1b5c2c1235b3498", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493819, "uuid": "bb33a4b8-2739-4f6e-9761-5a36608695de", "comment": "Malware payload (Dridex)", "value": "20d22fe36bbd36c5d6c88b01efb2c1feca93633d7d46ee6cc4021886a816e910f747e71ce34135db5cdb9abbfd495173", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493819, "uuid": "5c570508-f8ed-423a-9665-2df7c48f95a9", "value": "E8F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493819, "uuid": "e30a7f5f-8dc7-464f-b01e-22574119007f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493819, "uuid": "d2a2d047-1b29-4403-83a8-45bc07eeff27", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493819, "uuid": "3dd37966-d5e8-454b-9716-5c090b68c7a6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493819, "uuid": "ae5d6317-03f9-43d3-99ca-506845dd9b28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493819, "uuid": "532127a9-ae40-4597-86fd-350737296493", "value": "379354ae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c4f4be-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475246, "uuid": "7ce3da1e-a080-49ca-a17e-6a50552bb4a1", "comment": "Malware payload (Dridex)", "value": "cab61d6d4406d63eceef099f1972ecd6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475246, "uuid": "4cf2e847-e765-4603-ad9a-034fcfdbb6af", "comment": "Malware payload (Dridex)", "value": "21635f323c30fe71a6812dfe4ecbf43a9aaf21ccad60caa7bbf209c7f6144cb0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475246, "uuid": "4e389c3b-c341-4cfc-89f0-7a9a373b2884", "comment": "Malware payload (Dridex)", "value": "084bc5d418a942b3022190b78666cb30a2371c43", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475246, "uuid": "5eba9556-5b64-4469-a2f3-34da982eadc5", "comment": "Malware payload (Dridex)", "value": "53f54cdf3071b024ff1e2744b0f5f90f2def2bd9ae563e9e2c049e5d33e67fd9881b92aa720ade11d50564fccaf19415", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475246, "uuid": "3398c5f5-3263-44d6-93e7-dddc0f635260", "value": "47F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475246, "uuid": "03ff0245-b432-4963-b8e5-7a5c3966f8c0", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475246, "uuid": "5e1dd4a5-84a3-47a2-9264-1e2f2741d149", "value": "3072:LiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:oeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475246, "uuid": "948c6205-fec4-492b-ad51-578d012c3ac5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475246, "uuid": "e2c7a848-8101-49c5-9d62-99f223dfbaad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475246, "uuid": "73c5dba3-d3cd-44ac-bda7-2fa623034a7e", "value": "cab61d6d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ff3adf-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468056, "uuid": "ee5a2ad8-463e-45c1-921a-35f4453fdcf2", "comment": "Malware payload (Dridex)", "value": "e8b98d09b2d40d6d8c750837f5a8ae46", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468056, "uuid": "21f60293-882a-4757-8cbc-2870f0df2dce", "comment": "Malware payload (Dridex)", "value": "216379390cab8b1b114edbfb93e5d2a588e3d837d8aa2f09d9817b758e2958f7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468056, "uuid": "8026431c-ddb5-4e33-9e99-71c730ab9de1", "comment": "Malware payload (Dridex)", "value": "1d7ea1499c552692a875da874dc62fd02376bc91", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468056, "uuid": "d6bc1f04-d6a7-4c73-95b6-d72707ee8b87", "comment": "Malware payload (Dridex)", "value": "44985a0b83eab026185c8bb6a32a3a5122def0a506463b663eddf001f8563f5e70692042395b65f8044ecd409efd2aa7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468056, "uuid": "650b0e45-68dd-403d-95db-64352f8a640d", "value": "E1F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468056, "uuid": "b1adb15b-1c21-4301-9533-b6d091c2188c", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468056, "uuid": "eda056f7-906c-46a2-9310-8f677c8a161b", "value": "3072:wiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:beAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468056, "uuid": "17829b35-2248-4725-825e-3390e1609fb3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468056, "uuid": "a4bd3237-b628-4b76-b40d-2be9723cbe26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468056, "uuid": "844397db-e215-4993-b249-bc245dd80a54", "value": "e8b98d09_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb8127c-afc8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620456331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456331, "uuid": "7f569ef2-1dc4-49cf-8fdc-04122b915c03", "comment": "Malware payload", "value": "9123cb4d13520582f72266cdfe2eae59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456331, "uuid": "7ca9119e-81d4-4095-a2d2-7376b9ccb596", "comment": "Malware payload", "value": "21a80acf73e3f20e162bcd9e70aafa28681be230056a51bd92677a554e6d3ad9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456331, "uuid": "ef1f1d3a-6f3b-4302-9dcc-2b3f0dedea23", "comment": "Malware payload", "value": "4fe6566dc11863d493a7f694c249393f7fcb16b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456331, "uuid": "4e46f0e2-22c7-4988-9be9-69c2c01eaea0", "comment": "Malware payload", "value": "15b587e568962f9905e77f640c234941416380cadc8dc5c0937e522765b176fe6087ae88e162022c7e33058dabcaf888", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456331, "uuid": "9869a75f-3cac-4d40-9ef4-d1540e25495a", "value": "23356C649BFDCDAED07A257CA03051104AB2FE875703E78C6459BD39AC32702E995B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456331, "uuid": "11c463c7-2b25-42d7-93f6-acf00d92969f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456331, "uuid": "e6035824-c026-453e-9ac5-cd3004eee861", "value": "12288:GaPSbvrwbkNr3J8ATm3nxHw8sq66sHN6nMH8pOjQ:vSbUbo3F4AN/H8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456331, "uuid": "e019f22d-a675-4d73-aeb4-1dbb423c274f", "value": 1084416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456331, "uuid": "f1413f94-c066-4600-85d7-bd7703b2eecb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456331, "uuid": "fb9ae501-ce2a-4a76-b7af-272ec3d60f87", "value": "Zlmwf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbfcfa3-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435635, "uuid": "0ca794be-1050-49a0-8ad3-3ca5278b79ab", "comment": "Malware payload (Dridex)", "value": "69d31db29bbf6a05975be1601b617b4e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435635, "uuid": "e4bd2d46-805e-49c6-8c61-27fa9e0bf9c0", "comment": "Malware payload (Dridex)", "value": "2228906e50456d8fa91f778a6632bf16f21b01370561a4876b8a0694773944ad", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435635, "uuid": "881d3431-cf20-4049-80ca-3f53b1367bab", "comment": "Malware payload (Dridex)", "value": "ae70fed2daab31084a6813fa1a61758c193b219a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435635, "uuid": "06ce16d2-ecf3-423d-87ff-b73fcbd3e195", "comment": "Malware payload (Dridex)", "value": "7630f6fbe4f7a552faca3ecb467fe9ebfe2e611ca0d337e81a7f039441ac1fae05322139adf42a6f03d0c05445692320", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435635, "uuid": "53571471-66b8-4cf0-b6b2-128ebb1bce1a", "value": "02F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435635, "uuid": "905b3a6a-6c73-4eee-a62d-ba45620ffb17", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435635, "uuid": "0fa50fa6-6c52-4b30-add1-73a1b9fa0f97", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435635, "uuid": "bf2eadd4-14c5-4b13-b08a-04a5abdbb7ca", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435635, "uuid": "d71e2920-6247-4b37-b49b-c807821d92c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435635, "uuid": "43b67e2a-b489-4de0-8d06-cde853a8a0a9", "value": "69d31db2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0709e23-b04f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620514214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620514214, "uuid": "96222171-639c-40ae-bd17-1b6b15c883de", "comment": "Malware payload (AsyncRAT)", "value": "a55c198c27bb16d5b4e55eedf23511b5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620514214, "uuid": "c837ee76-5d67-4f85-9c26-123b335b00d8", "comment": "Malware payload (AsyncRAT)", "value": "22698a4849d7a46a4e2a626becfbeb3405d710fcaa0824b435b65621748a3eb6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620514214, "uuid": "880468f2-80f3-4515-9476-5513b1b47986", "comment": "Malware payload (AsyncRAT)", "value": "d957bf9cd0da15489a8cbcabef0fe99a5ed8c291", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620514214, "uuid": "f208cbb8-87f6-409e-bab6-79cb0585ad11", "comment": "Malware payload (AsyncRAT)", "value": "14c2afa6e4bc2cd4d82212001ac575e89dbe65ed910b1897946fe48052acd1dc1e77ea0e6e99546c5f7c24a51b6db77f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620514214, "uuid": "351f24ce-6a15-460d-98f2-7ff14d4ed853", "value": "DFF42336266756CFC97C81B482984648F3F0DF9B1252E7095EF57B2FCAFA3202981572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620514214, "uuid": "0f767556-4c82-414f-85ae-8df40caad0d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620514214, "uuid": "a79b0320-dfde-4205-9db2-9203d626d358", "value": "12288:cjbMuBD2Sd0yNPxJGgyUAYNU9hIuaP34OL06/QhBKFO0HowR3M6syT:ObDqqPTG3UAgghcbggF/owuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620514214, "uuid": "8b6e1576-3fce-4c1a-aae0-2a84593a7dda", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620514214, "uuid": "d929d8f5-b490-4a86-8dab-6b3d6b68972a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620514214, "uuid": "6314274f-6ac7-4b6a-a397-a7afd561c216", "value": "a55c198c27bb16d5b4e55eedf23511b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d086ed7-b020-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493834, "uuid": "a6b124af-b117-4df3-9ca6-9f82c01865eb", "comment": "Malware payload (Dridex)", "value": "3882ebcad17e76053d1fdd8d4bbd27fc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493834, "uuid": "1232f236-7b08-48eb-b5be-08a3d10cdb98", "comment": "Malware payload (Dridex)", "value": "227703042f84b55d82af37ad6ecfd76e11ae3f27d4d989073a178c8bd499a4c0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493834, "uuid": "c150e862-f61a-4edf-a8e1-1c1e0d0da4cb", "comment": "Malware payload (Dridex)", "value": "df848ee9156783fafafcb3a9d0d9c3c83f348b5d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493834, "uuid": "af561ad1-5340-4763-8a52-6516f51d017c", "comment": "Malware payload (Dridex)", "value": "1dbc440521aad38cce21a60c3db6ee124e0387451796dda4f098e8d1a956221297d157ba87aef0a8eb0aae6f186bea19", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493834, "uuid": "98c93053-fd0b-4c90-92c2-01adaa435b70", "value": "58F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493834, "uuid": "2324ec3f-d13e-45de-ad37-898837be490d", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493834, "uuid": "5521d285-c071-4204-b478-547d805f6075", "value": "3072:duFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:d0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493834, "uuid": "c088142d-38e0-4834-be60-22cd0c15ed29", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493834, "uuid": "fa616468-d07f-4b40-9bb8-f7ab342f9ca8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493834, "uuid": "a2cb19ae-48b5-4e3c-88bc-bca6e76f7fc0", "value": "3882ebca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fa9310-b052-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620515181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515181, "uuid": "e441110f-d8ed-4a92-bd49-9db5a37c914c", "comment": "Malware payload", "value": "90f4afc016da4c98ac4c5dea2f009818", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515181, "uuid": "63017dde-566a-417b-8919-4de24ac42e66", "comment": "Malware payload", "value": "22be8960adb30c5cb4f571ee1e9f073789415c82d5aded223eb89add0cae1ac0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515181, "uuid": "feafb26c-2044-478f-b610-b38046016a75", "comment": "Malware payload", "value": "5bed0cfcca209938ef936f78205e402ff8b3ceb5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515181, "uuid": "12b534c9-18a8-4d9b-9f15-f94eca0c9100", "comment": "Malware payload", "value": "4fd6e2dc808ab9d93202cc9b8df9ae9e1594dca3575fea36cba7bea8f2803c3962bae04f9fc2591d2389e8b8ffe02cf8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515181, "uuid": "fd487571-37e0-4c52-abb3-5d4efe68ac3d", "value": "FDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515181, "uuid": "acc53b7c-acd2-4129-9b70-ffa019717508", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515181, "uuid": "79838d07-908b-442c-af53-caa8c029f857", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620515181, "uuid": "b9a2b7c7-7be2-43e6-b3d1-bb86f4f6eb33", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620515181, "uuid": "e37a50de-0e48-4108-9bbe-a0e88ea712fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515181, "uuid": "f1294436-8c2e-42c8-a82d-ffbd821ef0cd", "value": "90f4afc0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b86e3e-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457373, "uuid": "90995f7b-4aa7-448a-85ae-f9bc219dd2f6", "comment": "Malware payload (Dridex)", "value": "184f35f0c32eee822301a20f51238bdb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457373, "uuid": "470fefce-40f2-4225-a324-064c2fe73c24", "comment": "Malware payload (Dridex)", "value": "22cb89158b3a40a4c6f02ed13d136a6b5a36afca0af5c68b0774da176908264a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457373, "uuid": "c075804c-5dc1-49b9-8d3b-25ad455b0037", "comment": "Malware payload (Dridex)", "value": "846515c4b33981187c61f88ba24318c0e3e9a997", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457373, "uuid": "909cd157-64f1-402d-a740-43cce0f3d996", "comment": "Malware payload (Dridex)", "value": "388f10837c3d4172806750b7cedb99ea3f8407ba63982d1dc4a49f24c899a2fc90a05b28701f8c2c96127800f2a37b17", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457373, "uuid": "02938468-91f8-4443-95a7-9c3c2b778199", "value": "CEF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457373, "uuid": "c13ef181-731c-404c-9dd7-4e0d6f8ff2d8", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457373, "uuid": "d3c760d2-1861-4ae1-9fcf-33b021cf87e3", "value": "3072:mWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:m42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457373, "uuid": "04baa64f-bd88-4741-9141-c640b5ce208e", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457373, "uuid": "69c356a6-9ce5-460a-b3ab-895e56735828", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457373, "uuid": "58d2faca-ef91-4d73-9776-094999bcfebd", "value": "184f35f0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651532e8-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468104, "uuid": "1001ab28-e93f-48d3-9c05-842881ac6216", "comment": "Malware payload (Dridex)", "value": "45f562a0d0dc1de15994dab29aeba02d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468104, "uuid": "c824be6c-ea46-44bc-b66b-014c8798f447", "comment": "Malware payload (Dridex)", "value": "230b37752c4cd17d0c9d041536fdd8117b9407918a787535c14a004c1dc4ba1e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468104, "uuid": "00b042bc-b9b5-4081-b621-391e5a4e9325", "comment": "Malware payload (Dridex)", "value": "902754fef6d6ea60304615f1860187cd1ede7225", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468104, "uuid": "28ca4ca8-4e2a-416d-ba23-9b41a29a8d0f", "comment": "Malware payload (Dridex)", "value": "710dda765e796355b4178623bbc5945446e84b3f89eba41db701970e88ee72d8e62fe20ce5154d5f911668d097bd0ea8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468104, "uuid": "f203fea1-9fb5-4b75-8d69-2ca8e8efbd7e", "value": "44F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468104, "uuid": "383a07f0-520f-45e4-9ddd-71215a64ec4e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468104, "uuid": "4f7fd6a4-9e3a-43f4-8c27-874337c3edec", "value": "3072:iIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468104, "uuid": "3992a897-33d7-4697-9fa5-da188d91d492", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468104, "uuid": "5ac6df30-fbb4-43d1-bc80-52381d00d4a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468104, "uuid": "b1771381-0e6f-4838-bd2f-5934f4c3bb98", "value": "45f562a0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77883c00-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432058, "uuid": "f96f8c12-2ceb-48d5-bdca-e85d7e118d9a", "comment": "Malware payload (Dridex)", "value": "3f6a053d499e9f0dbbfe82f0b6f600f1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432058, "uuid": "5896eb25-ea9f-4f3e-a662-db7038ab0299", "comment": "Malware payload (Dridex)", "value": "23137824a428ae7eeff2398dd88a417c3d76cf5c0c25553acc19aaed8660e3b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432058, "uuid": "6f3ded1b-970e-423d-a491-dd11529c69b3", "comment": "Malware payload (Dridex)", "value": "35e1dd89e7eb90fbab3904bba5dd5e48d1ce7d7a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432058, "uuid": "0fe8971a-95e3-4008-9317-f2e1d75bbc43", "comment": "Malware payload (Dridex)", "value": "31f94ee3300d85746519314809652d57205f9776cf4811ea912a49dcf9b43cd0f091f992fc39994871eb4254ed362970", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432058, "uuid": "38a6547c-a861-4371-b8c0-41dc3accf795", "value": "7DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432058, "uuid": "e97c7efb-c443-41d6-a82a-7242b66b1f73", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432058, "uuid": "2af3a953-1627-4ccb-9166-2bfb49e144c4", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432058, "uuid": "d1a9d749-2f6b-45d4-b3a8-6c58e1a222c4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432058, "uuid": "706597fe-7186-495f-9f69-665e34a97b8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432058, "uuid": "90a1bd19-5228-479c-b79b-8b919722b2d1", "value": "3f6a053d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678d98b4-afba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620450070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450070, "uuid": "77ad7e3d-8bb3-43ce-bbbb-13f69abe6c66", "comment": "Malware payload (Dridex)", "value": "9910a9a4cc0e22b415f6b0dff13391fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450070, "uuid": "9623380d-12b9-4cf7-8e9d-b5539e919d55", "comment": "Malware payload (Dridex)", "value": "2324f5f1fb386ccc35022dd88b2e84ad39d1f88eeb074aeb9c8f0624ac245556", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450070, "uuid": "a9db73bd-a33c-4fe9-941f-af2e8d104d40", "comment": "Malware payload (Dridex)", "value": "087d58b5ab744bef21126d9f36feab75f9610091", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450070, "uuid": "5caebaf5-6c55-41ec-b061-309ff855d4e3", "comment": "Malware payload (Dridex)", "value": "1ad546b5ac1c6e1d725b899b4587cba8b4ee1b884613e1d150e2991b5d36c12f9d3e57e896d2dff87929ff6f905d8a86", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450070, "uuid": "b9310979-d941-43ea-9c34-f5180e00266b", "value": "56F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450070, "uuid": "88dea089-24fe-4b7f-8863-beec26ceb5c8", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450070, "uuid": "d4e48b42-1be1-427a-9021-c88a3ab0805d", "value": "3072:wiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:beAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620450070, "uuid": "2ae8fc8d-76f7-4010-8128-d0d6ed5ab382", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620450070, "uuid": "316c6d65-e16b-4325-bfe1-134d2b3c9200", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450070, "uuid": "33fb9766-6d6f-403e-bf7d-bf08ff10dd8d", "value": "9910a9a4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1422fcd5-afdc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464533, "uuid": "e776655f-130b-4591-b41a-88c8650081b0", "comment": "Malware payload (Dridex)", "value": "1caad9c2b4b319fadf9649213b5c5f88", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464533, "uuid": "b6ace50a-223a-4ae5-b58f-20081505cd75", "comment": "Malware payload (Dridex)", "value": "23834d2ed7850d50fc3e8d0c145a2869e750233b79a6d6261cdc96d63f6f1f26", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464533, "uuid": "dce0c9e5-0a01-4516-8667-d991e0fed3c5", "comment": "Malware payload (Dridex)", "value": "9168ca2c45a96bd5c00926d951862686ae1f49ad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464533, "uuid": "a16ffdb6-8d6a-4028-bb51-854fd242d1e2", "comment": "Malware payload (Dridex)", "value": "e810396a50c8edaae42ea00581e5c7bc6fbffe61b5d9078d2027456d061512ff2005e37d5c7b6267fa87570788bd6ad7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464533, "uuid": "6912c2d0-7620-4bcb-a7da-adde5fc2c7fe", "value": "BAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464533, "uuid": "7dbe5cca-7983-456a-97d8-83fc7cd70162", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464533, "uuid": "79663817-6437-46cc-b861-612af8bdc924", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464533, "uuid": "40819bd9-2d83-46fa-a129-08b2a6dead6d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464533, "uuid": "e95fda40-0b72-426f-ae37-68891a3b2d71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464533, "uuid": "cd1e2329-ad98-49b5-aff5-f7f75d252b8d", "value": "1caad9c2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98733493-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460889, "uuid": "48f565a4-efdf-4182-943c-aa131b85edb6", "comment": "Malware payload (Dridex)", "value": "0cae6c56e42bfec693186f0c1ffd7256", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460889, "uuid": "a6373a80-057c-4705-b759-16b74cd8cd69", "comment": "Malware payload (Dridex)", "value": "23c2f71039d75055411b272a51ed8e7394484a3d6aee58ac41ef80f4f9fb4e71", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460889, "uuid": "a2d58629-6278-436c-90ce-42db290426df", "comment": "Malware payload (Dridex)", "value": "0e7dec7424548d08d809d3e5ddd214391fbb9244", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460889, "uuid": "8cc448af-1618-4650-8444-ff092e3b6743", "comment": "Malware payload (Dridex)", "value": "2965f473d7e943aaa782b0f1c2ec5a8b376860810acfaf71476fc18470c885756bd7aa28fa21fba87408484cddfa1204", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460889, "uuid": "31d7f38f-48f2-40bf-9e66-5fcdb398883b", "value": "E6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460889, "uuid": "4eb15c18-ed7a-4264-b75f-af84c4688db1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460889, "uuid": "a90c13c7-b0ee-4db6-acfe-319132c974b8", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460889, "uuid": "4b249a80-b717-4532-8363-a17a41af9ae1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460889, "uuid": "2f3c0240-853b-425b-a90c-5edb1bc4caa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460889, "uuid": "021c8a1c-7ce4-4fde-93af-8b973dbab32f", "value": "0cae6c56_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfbccdbe-afdb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464445, "uuid": "78cef3f9-8d7c-4f8f-b3af-47ee055ddd50", "comment": "Malware payload (Dridex)", "value": "7ed8e7ee96d65719058c15061f4851a8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464445, "uuid": "296163b9-0719-4ed1-8f66-1651a3db90cd", "comment": "Malware payload (Dridex)", "value": "2443ca0b56bb1dcc59a3272aa26f0b61a112222d6117759db9cc8415d9955981", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464445, "uuid": "36b9262b-6a4c-4699-9eda-d73f3e845231", "comment": "Malware payload (Dridex)", "value": "6ddc4d4f8f17750340705e18283dfdf81ec50789", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464445, "uuid": "145ea68c-f013-4c05-becb-ae18c667c0a0", "comment": "Malware payload (Dridex)", "value": "03a27caa21110be56b0051303bd8abf191be16cd077cf899cdd1d3c2380679ff8062dae56ccda83808237361077c0ab3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464445, "uuid": "1dff2a7f-78ba-48bb-96ab-8ec18365479d", "value": "3FF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464445, "uuid": "1c560be4-021a-46d7-896b-58c45e2f9e89", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464445, "uuid": "e5dbe530-8b67-425c-bdd8-093e821b5edf", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464445, "uuid": "e799ff26-3698-462d-b151-5e61a064bc86", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464445, "uuid": "df746dda-9de5-42b3-b3ae-a93b58ac6ed8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464445, "uuid": "ccfeacbc-0b3f-47fe-afa6-62d69db57103", "value": "7ed8e7ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6b96e3-b038-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620504275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504275, "uuid": "a0436af3-5f98-40bd-a43b-47c84f3e8647", "comment": "Malware payload", "value": "8d80c808d997e7377131f47f5c23d6a9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504275, "uuid": "ff6e4b76-19a7-4fcf-958a-f0fbff9c6442", "comment": "Malware payload", "value": "24b59411bf638123e22ece71e83ed4f99b4f756c7dd50c17520f17c612157917", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504275, "uuid": "99d0c347-7010-4492-9490-c2b2e052fbc6", "comment": "Malware payload", "value": "4f1a27f7ee40b653b4002162bb5f8466b0892923", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504275, "uuid": "da74f544-b76d-41c8-a029-48c08b5a8392", "comment": "Malware payload", "value": "7f0faa62b3c1bf266f402d65e1186b11491e2c4c26dad99ad0df5983ffc5bd8588106cfbb3f979fe4015efc0a62875e3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504275, "uuid": "6ad260c2-37f6-4210-a185-da9f6b99aaa9", "value": "85F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504275, "uuid": "26b81bb3-69d2-4d0c-bd6d-5147c2690228", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504275, "uuid": "57b029a5-8bb6-4f11-ade7-137d9c9cac95", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620504275, "uuid": "5d06a7af-5262-4e0c-ab54-2e1e5269dfdb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620504275, "uuid": "ea0050b8-6d30-4d5a-8627-e2356eae6239", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504275, "uuid": "eb2ccaed-3ea3-4b82-a9f0-d853c6f7b4fe", "value": "8d80c808_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d2f2ae-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435648, "uuid": "60d88e36-ecd6-4893-add2-059467685ad4", "comment": "Malware payload (Dridex)", "value": "5c3f23ec69658059e22839769f7f935b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435648, "uuid": "e26d3bab-f9a2-4f5d-8d2c-ae1384e2b52f", "comment": "Malware payload (Dridex)", "value": "24e68f202370a34e14fb0f5a08c5bdc18c0f222dcfd9270e2f45c01c0be0ae0c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435648, "uuid": "77cbb998-bc6f-4812-99eb-6256b97389ee", "comment": "Malware payload (Dridex)", "value": "9b8686bb5b0749029ab6003e616fbdb677a10f51", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435648, "uuid": "a52a3e78-a5e2-4e14-a497-6fcde16e6d1e", "comment": "Malware payload (Dridex)", "value": "eb56233be8430eea6ca7850e783e33c134103e894cc7d3c10a1e0fe1f04325fe7b757c88156d5f51cca4d2ae7bc1408c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435648, "uuid": "339f247f-b3b6-40c8-8b42-0b36b1b38261", "value": "EFF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435648, "uuid": "7293a32e-aefe-4e66-a163-44b595d3b28f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435648, "uuid": "57975b02-19ae-4bbe-8fe0-3c86c7772116", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435648, "uuid": "d498db07-77f9-461e-b6e6-d6fcfd992f3e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435648, "uuid": "95196367-229a-4dde-97cd-ac0f8f425a01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435648, "uuid": "f8f60e2a-f0ef-4ce7-86bd-7842f91bfc9e", "value": "5c3f23ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b4e519-b01f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493526, "uuid": "98a2a297-0244-4819-bb04-1bd2787465c8", "comment": "Malware payload (Dridex)", "value": "48d74d2512e4adc2a55bc2520a0cfa55", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493526, "uuid": "c04b0833-adad-4105-bf89-c73daaac0fbf", "comment": "Malware payload (Dridex)", "value": "2528a9b2d9dc2276e6d8f53bb03c10bf266d6ce4f5363371e22289f70e12d5f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493526, "uuid": "d98a6ef0-e4e9-4851-8248-a0c291162db8", "comment": "Malware payload (Dridex)", "value": "e571e04bfc278ed56b04edf17988362c6dad073c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493526, "uuid": "92fb6de8-874d-4f30-960c-779842f4da22", "comment": "Malware payload (Dridex)", "value": "96874a9e71a67a0c96bff745a9512d17dfe1012b51931a6857a344ec40f85de519ec7fcfea84528487f210adfd0b41e6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493526, "uuid": "2baf1eaf-ec2b-4a62-9845-99308fe4bda7", "value": "60F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493526, "uuid": "94845d66-5d34-42bc-9388-f8df2af69eef", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493526, "uuid": "0f6ca999-837e-4bca-b691-35512a861cfe", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493526, "uuid": "cd192fb8-63ed-40d0-98ea-87f9c9a1e05c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493526, "uuid": "be4514da-fb49-4c20-a250-c70491efefb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493526, "uuid": "38b7e5b5-3442-41b4-9c87-73f4b5ba8925", "value": "48d74d25_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ff8290-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475302, "uuid": "5ea798d7-49fc-488e-be80-188266f68af3", "comment": "Malware payload (Dridex)", "value": "c0ac18de0b51578de0f6b7f8f8fc6220", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475302, "uuid": "de6edceb-7b6c-4314-a635-c42c4402b581", "comment": "Malware payload (Dridex)", "value": "256b50bb3e84820665477b76ba1a0e86c3a5b61bb525e73bd0551a1d5a42ed85", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475302, "uuid": "b634b6d9-f2f2-442e-a2d8-84aec492a8cf", "comment": "Malware payload (Dridex)", "value": "09bff81d711bc2ff0880d533df98e71040088120", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475302, "uuid": "a7904a2a-4ceb-4e9f-bf21-d4abac1b0824", "comment": "Malware payload (Dridex)", "value": "ea1655d37af47c0cc1e19a6f7e2e1e967e5b352f28c393f6c91fa8950c91faf2b68fb0b03876aceae86d913625c94ead", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475302, "uuid": "0a333f89-d91c-4efe-b5b3-3b94dfba53e1", "value": "CBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475302, "uuid": "1d98c29e-ff34-4f95-831d-a6356cea42c2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475302, "uuid": "1f651266-93c2-4fbf-882c-57e107bc6d7f", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475302, "uuid": "87074de0-f98a-4cea-b472-9d9fe905921a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475302, "uuid": "ec83245f-9ea8-4dba-8ddb-87ff0df71cc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475302, "uuid": "040d005d-d7d5-4f9a-a560-df3e2bdf7847", "value": "c0ac18de_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba91b147-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471684, "uuid": "507d9b47-ff30-4b64-a803-f83f0aaf318d", "comment": "Malware payload (Dridex)", "value": "ad08f9ae17ff23c919b9504945422799", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471684, "uuid": "27aff594-d07f-4d40-8b0f-47d3d92ab322", "comment": "Malware payload (Dridex)", "value": "25b794ff88d3fba4b4c8199ac89871ff377f8c99577ec3733dcbd4d98fb7b980", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471684, "uuid": "34fc60c8-af4e-441d-ab5a-2a966bd7d445", "comment": "Malware payload (Dridex)", "value": "d2e24923e85807622acf9b47b0a7d44e8c12bda9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471684, "uuid": "da842aff-9ee6-440d-8d42-104f66f96784", "comment": "Malware payload (Dridex)", "value": "34683045e56700120f58f55f1438e39ffb76fb56f47bc895ab88ed9534ee239804315e5b23d96fbd34fd7e5029d5aa77", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471684, "uuid": "89cb53ab-a58e-40b1-bcf3-e0b6a4caed88", "value": "76F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471684, "uuid": "61ee8e76-8431-4108-99ec-bf17d67bf1b2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471684, "uuid": "6fb4a376-0105-482c-b78b-99c81c2ebe72", "value": "3072:aIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471684, "uuid": "a8ada467-d47a-4ab2-ae13-06368138939e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471684, "uuid": "473debb2-6492-4c7e-9ad2-dae1f05a3bc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471684, "uuid": "9f7a9999-e9c0-4230-8eb8-afff85816064", "value": "ad08f9ae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580c503f-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "a4323728-1ccb-4283-86c1-6521bb619813", "comment": "Malware payload (Mirai)", "value": "f830ce3e46189fc56439ada1820508ef", "object_relation": "md5", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "5e6f297e-cf5c-4a4d-9ec0-de9907baf950", "comment": "Malware payload (Mirai)", "value": "261e448f390a040697ffa5247f0d1ff8ddf1462c5fa7ecd9229ebc2a5acd9047", "object_relation": "sha256", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "50599907-d791-4e9e-8f9c-fc1a60251a06", "comment": "Malware payload (Mirai)", "value": "62d0284dab5a9f88abb31585e87fd85c5c494d94", "object_relation": "sha1", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "dc703fd9-6deb-4591-8f27-97576ed9e860", "comment": "Malware payload (Mirai)", "value": "3276b08ce459f101b043a1bbf3388eac90706f129b10b2eff2a4b688de6b11e069809d0c8c7cad3603cebeef484c8933", "object_relation": "sha3-384", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "e2e05857-7132-4b4e-9e21-372b17a6318a", "value": "95430161D65F1E539AB14C7140F757977D27AB7BE33538C12F13202A02E484A9B3529E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "1c098840-5507-4d6f-8e74-facde7d78991", "value": "768:HlPpSEZdHdqS0Mho+B70YV1IQ94KXJ6DocObKbZJDDuQCUuNV9q3UEL9XmHJJ4J3:HV7D9I+FvVn6XVu7UgoL1kv4xrjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475384, "uuid": "9b94d0e2-75c1-4acf-8c75-73f3cc7ed15d", "value": 58408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475384, "uuid": "0e2a6263-b92d-4e3a-99ab-2946fe3dbef8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "472622b6-cea9-4b8f-8f2b-d0537c67c799", "value": "xd.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4547ad89-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468051, "uuid": "5ca8f1db-79b2-4e6c-b580-2ead73f5195c", "comment": "Malware payload (Dridex)", "value": "8f4d794ec39522f2bd8a2b6837afe990", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468051, "uuid": "5ca9fdd2-423b-4b70-8ed5-4a0ec40ea185", "comment": "Malware payload (Dridex)", "value": "269a2d8f2563209d126be968b4912472ca5f22792007fef1a36bd26d53b5476e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468051, "uuid": "b7fea79b-6c3c-4a87-9b4d-fb616f11d524", "comment": "Malware payload (Dridex)", "value": "47853a702dc4c836fa0ae44b3cfbaa0e9c790ddc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468051, "uuid": "ac8763bc-dae4-45be-b60e-326282aea0ae", "comment": "Malware payload (Dridex)", "value": "70876df37a1b26f565bccc88a0767c386a5cbce59252d87f8bf886398bcc4273e15b61e7dc4c810cfd3861507b1923ec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468051, "uuid": "a3a8ade9-bb4b-4378-aff1-f59eb85f407b", "value": "BDF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468051, "uuid": "9843a77c-4f3d-4511-a5b8-efd017cae1d3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468051, "uuid": "2a24fc8e-aab9-4465-80ff-e497ce12dbf1", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468051, "uuid": "881607c1-5a23-4003-bbb3-d9ee25a54cf2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468051, "uuid": "ebe5af60-f0e4-4f8e-bba2-974a339ae9cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468051, "uuid": "4ab7fb79-03e5-4340-b0c5-9bf136f954be", "value": "8f4d794e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0dfad1-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478905, "uuid": "49eca77a-ca63-48da-b2f6-e31b5493fe48", "comment": "Malware payload (Dridex)", "value": "501c2ab5d5599dfb406c9c09dd97f651", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478905, "uuid": "da3620db-7b1e-425c-837e-1d8b13a707bb", "comment": "Malware payload (Dridex)", "value": "26da2494d3fcb5a7e6f75be9bcc3654dc0556db73c2f93dfb73484e9ad0097bd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478905, "uuid": "62b43129-c44c-475d-9e40-cb676c1f3a83", "comment": "Malware payload (Dridex)", "value": "69e47dcdaf5d0e71bdab45a7cc707bbd9cca0a09", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478905, "uuid": "1b13a4e7-f336-4356-928f-4eca03c21630", "comment": "Malware payload (Dridex)", "value": "bf445fa33d4317dc3cd3ba241ba80987266cc0089cc56d764bce111ca6e12a97a9ad73c5519f3497fea4126e5a1cf187", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478905, "uuid": "edd75f68-8dfe-4dc9-ac64-762de50e3b02", "value": "1FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478905, "uuid": "5144ca6b-b8cb-4392-b7f1-ebd07addab8b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478905, "uuid": "c7bc4d3f-6f0f-4cc7-bf1c-1aaa5b5e6361", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478905, "uuid": "686d9ba7-257a-4f6f-b9d3-15b2d21d5711", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478905, "uuid": "dece8a14-0887-45c7-84e6-8aeb1e53d9af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478905, "uuid": "09761bee-a719-428b-ace3-c7a56131f7ff", "value": "501c2ab5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30afe70c-afa1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620439240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439240, "uuid": "94baa4fb-1589-482c-8290-1572fdc108c1", "comment": "Malware payload (Dridex)", "value": "8efff34a4a8493b08ded99f92dee7aed", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439240, "uuid": "42b73208-5fe2-42b7-8837-916a73d392a2", "comment": "Malware payload (Dridex)", "value": "26f0713cc85cb9b3b2fd0273a251d292b840493571e7ef671a13143ffe43ae53", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439240, "uuid": "aa8ead7f-7af2-4d41-9957-0b3552b887e0", "comment": "Malware payload (Dridex)", "value": "d600189ab82c50ae007e9c7746ebd872c834dbff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439240, "uuid": "4f978793-bdfa-49e9-808a-616fcbe9499f", "comment": "Malware payload (Dridex)", "value": "2e182da980e9c311ff8ae27b3fc4f31bc20798c142f83e736481b46bd2eee4c6930e3616619918a54a1babefba10a4d6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439240, "uuid": "00726a04-6471-4efb-bcdb-d520ec46ee0f", "value": "80F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439240, "uuid": "e06377e1-b59e-4b5f-a5dd-60ff4e8a8c3a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439240, "uuid": "f20d828d-8fd6-48e0-82c5-056419d56a13", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620439240, "uuid": "d28ff6a4-5f08-4c6e-8a2d-f1141b583c64", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620439240, "uuid": "45dcdfcd-248c-4313-80d6-7f49d22a9a4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439240, "uuid": "8a05dffd-8f30-423f-a881-4eb69424e80c", "value": "8efff34a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c2d5c2-affe-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620479247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479247, "uuid": "2a9bb6f5-d946-40e3-ab0d-d8bfb7a04153", "comment": "Malware payload", "value": "bc02549e5e87e2e01868e3eefc0cdc3f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479247, "uuid": "82a5bd70-11d0-4b95-9b4f-464b3f30bb00", "comment": "Malware payload", "value": "270ba1baa2c59c864e8ec517d7d4ea7856cd1c42f97a33a8c9eb9948fac1d0ff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479247, "uuid": "876c901a-c573-44f8-8f50-9a94a140da7a", "comment": "Malware payload", "value": "78f119a416896d6ae314f180c3d69614f0efadbb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479247, "uuid": "f465b10d-107e-428d-abfa-9bf132c300bc", "comment": "Malware payload", "value": "9a03cb0daa53e59d932c4c50d3eb9fdf1c9423a38a0bd07c49ea8fdf7f14d667f44985db2ba521c6beb7c46c15bd41d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479247, "uuid": "699fc56d-9c12-48cc-9250-bc3f3c57444c", "value": "57247D11F2C24876D1631F38BC2BB26E5A36FF512D29654BA6F95D0C8E3E3817C185E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479247, "uuid": "0eec2606-60c8-49a1-8949-d9dc95a25419", "value": "ff5a8f4780f2dc45750b55ab89f4b357", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479247, "uuid": "6bcabccc-ab07-4592-bdac-feb175a25a43", "value": "6144:SJ+WK/pvT7arfwKFzDTsv5oaTh45CjBscX9TvLN:JJpb7Y7vf5i5X9TDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620479247, "uuid": "b340fb21-fc5b-4c86-aa44-8b966fec8039", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620479247, "uuid": "f1c09d41-925f-48f0-88b5-e668132858b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479247, "uuid": "4e8de419-b07a-45b4-a41b-dddb5eac96b1", "value": "scr.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14d0751-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478970, "uuid": "13b799e2-1157-48ca-b6f7-be0266c9eb30", "comment": "Malware payload (Dridex)", "value": "21b2644493abe570ce74d1fd802009f3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478970, "uuid": "80d4d683-3c76-47a3-9939-3662cc79165b", "comment": "Malware payload (Dridex)", "value": "273246ec0da9be6534f68966542f498c682de3c9d9231f8e16ec9c86215b0550", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478970, "uuid": "360b23e6-23e0-4553-b6d2-09e2e47c2061", "comment": "Malware payload (Dridex)", "value": "0f4f221bfd6906563fac6f3ca940fb61bee4ac8e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478970, "uuid": "9c4d785d-d1cb-40c3-a6b3-169b26f9a20d", "comment": "Malware payload (Dridex)", "value": "6e109e39f7dae5f2f8c09d80360e4a869f27259e19f597f110f7bcf57b59ed6ad8f0c8352db2b7543bc6069a98299bb4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478970, "uuid": "11b728bf-7508-49b6-a140-969638aaf57a", "value": "7FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478970, "uuid": "ffcb2d57-5931-4974-b894-42f4f015f0b5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478970, "uuid": "bd1a05d2-d125-451c-a50c-050fce73bf2f", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478970, "uuid": "a9bba73d-e6ce-471f-832c-871443153a5e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478970, "uuid": "c8206bf3-9a45-4e2e-b0bf-d69520e2e125", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478970, "uuid": "a4775e36-0537-45eb-bcd9-9e32b4bbeddf", "value": "21b26444_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4877f2e9-b020-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493826, "uuid": "569eadfe-17a6-43d9-a74a-541007feec2a", "comment": "Malware payload (Dridex)", "value": "99610bba9edafd824249d4345395d89f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493826, "uuid": "04bb49fa-1f55-4075-b1c6-da9f6c8b2720", "comment": "Malware payload (Dridex)", "value": "281b6ddf1c62f47ab8bbd1b3dd06e2b2bfca9ccca4c308018b897418bbbca420", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493826, "uuid": "cfee62d2-71cb-4139-8b42-0f3f4bc77a38", "comment": "Malware payload (Dridex)", "value": "9ec46f2fc1611a86b2d7219ffa66d44b5137d7e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493826, "uuid": "8ffc994b-dc95-46be-8c87-3e1696727a0f", "comment": "Malware payload (Dridex)", "value": "3b6fdf48601692411bd0d18799639f4fd76c443bf8ce4fc324220c5423e2c0eb53d05a59ec780367ef6f58516a9b2bc7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493826, "uuid": "75ffb691-f237-452a-8cba-05178bb3992e", "value": "B6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493826, "uuid": "2f3ca1c7-8a17-4dbd-a604-87e315f6776e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493826, "uuid": "1a1de3e5-a20a-49dc-8848-a92c815d6204", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493826, "uuid": "ca31d6d7-18a7-4b79-8240-887a79511609", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493826, "uuid": "a67b6565-720d-4c75-8a99-f35a335c352a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493826, "uuid": "2b99a9d8-e1a6-46aa-9c5b-86a23d0d4ed0", "value": "99610bba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f555fb-afdb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464457, "uuid": "abb36c56-423f-4463-94c1-79cc95cf3379", "comment": "Malware payload (Dridex)", "value": "9920a9ba3febad78b2105df5cb782751", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464457, "uuid": "e494d836-f345-4d7e-9621-2c49d158dbe7", "comment": "Malware payload (Dridex)", "value": "282e4b6e6b61a9e794b638619d0f0387b080c93cae0c944d7f53ed4a4ba70827", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464457, "uuid": "b7d354dd-9acd-4f89-b3e7-6d37ecbb5c4e", "comment": "Malware payload (Dridex)", "value": "71a4c2254c87660a5d7da175882926e664b42afe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464457, "uuid": "926e698f-3169-44fb-9dcb-bc5596370a3b", "comment": "Malware payload (Dridex)", "value": "b3a789d46b7853b4e52202f2e8f8b5387ef279bcaad5fe1ef5c565c4aeee82ba7d41f02b7cb2fa353e898d7baaa4125f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464457, "uuid": "248472c9-79ce-49a7-8626-119f93197365", "value": "11F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464457, "uuid": "8c5e77d6-5a7b-415d-8003-c7bafc6ba5df", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464457, "uuid": "3f9cef80-fb2b-46e9-accb-af6ab1012d9d", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464457, "uuid": "e2786e8f-e6c8-485a-9721-51ab7049ab0e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464457, "uuid": "e53d94da-e887-4f82-9253-d3a5431cc132", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464457, "uuid": "9e56aeed-4add-415a-b69d-a1ea24ded34a", "value": "9920a9ba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50f9ad5-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471648, "uuid": "9c8f6470-6d9f-448b-9c29-2c504d50ae4a", "comment": "Malware payload (Dridex)", "value": "5c3d6db8ee3cd2bb07b76fa4812b2f6c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471648, "uuid": "df86a290-c1f9-4bf7-ad5f-61bd7d3b1a2f", "comment": "Malware payload (Dridex)", "value": "28b026c108267b913732218570004fe0667a4d9146540a1e1795cafcbe55b7c6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471648, "uuid": "85e3ab60-ea9c-41c1-b5a9-70b9ff4512b4", "comment": "Malware payload (Dridex)", "value": "0063734ce7d1ea8b9125869173b3cbcbbc883cad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471648, "uuid": "44f7bcb0-ca57-40a0-aee3-b7a8be3d4cec", "comment": "Malware payload (Dridex)", "value": "7b999d950ae89f239a9ae2a24b4d976b4a48217d3448036885ba7733120530d0a36524a13405fdc63a95165e3ded57e4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471648, "uuid": "edc02cbc-a4f4-43cc-8e88-caccf7b9e3fc", "value": "67F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471648, "uuid": "b375084d-805d-4f92-a39c-a6d09e89df24", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471648, "uuid": "3a22ddc7-8910-4c94-850b-ede38123db40", "value": "3072:FWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:F42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471648, "uuid": "07a73ee0-d170-42fd-b863-df2703d0312e", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471648, "uuid": "d17491e3-16ef-4aea-983a-ca8e35aad958", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471648, "uuid": "442d59f8-864d-497f-8e85-c55f1ba1e21f", "value": "5c3d6db8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65c8b8c-afc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620456215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456215, "uuid": "43cdf351-310c-4b3b-9e04-faf6da4b8c65", "comment": "Malware payload (SnakeKeylogger)", "value": "c676d52390ccc4f928674f1418dc50ef", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456215, "uuid": "ea0136f6-f82f-4272-9989-c0b565d415d3", "comment": "Malware payload (SnakeKeylogger)", "value": "290f4b5833a5971d004e82f37366080183792e577d8cb0be18ac17244ce78490", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456215, "uuid": "ad7eca84-12f8-4101-a3cd-9c84b4e735ec", "comment": "Malware payload (SnakeKeylogger)", "value": "1d26886793f2c1463f19c44d278a9582507aaf2a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456215, "uuid": "a5cf9122-5937-420a-a2d7-34572ca5b2e1", "comment": "Malware payload (SnakeKeylogger)", "value": "b9500ebbf7d2609bf642988e05d96ba37a7ebe70ceb0be7abc6de5e370ea103d0da0b55b7ef4e340ef424e32aebc1f15", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456215, "uuid": "bfaea13a-45d2-4579-b950-9db90f72dae3", "value": "66355D6AA342D0C4F56E2472CDA0FBF4051BBD2BCE0A5E1712563FC2747BA9B563A143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456215, "uuid": "68fd83d5-d7fd-47e5-ad00-a08558bbf88f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456215, "uuid": "363f8139-6ba7-4ec1-b6a0-c08d9a87530d", "value": "12288:SFGfC8rrreWRdr/Ek4RqB4+tUPoNhwGlYBV8ySQluKTi2HMyc6LRM0Qtx1:SQC8rrrdRJ7/0AhFmEQluKTiu9RRW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456215, "uuid": "268f985a-a532-4c0f-b5ab-a23a499494da", "value": 1104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456215, "uuid": "89b878db-c71d-4a9b-ad6d-dd0f8ff4eb6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456215, "uuid": "ea74ab64-61d2-43e0-ba04-01f45f9b0918", "value": "DHL 4677348255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a7a1f8-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457235, "uuid": "2ff43510-19b3-44d9-b9b7-96251d07178e", "comment": "Malware payload (Dridex)", "value": "57721a0b7319a633b7e6c130b0dd4edd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457235, "uuid": "987f7d54-5f32-4f11-a75c-abd0d8a4194e", "comment": "Malware payload (Dridex)", "value": "29ffed288d6fcb7415525a691b5a3ac5bc4ef8b549f6227f2e68bdcfdedddd49", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457235, "uuid": "a1f6108a-011b-42a7-9967-d433b88e8460", "comment": "Malware payload (Dridex)", "value": "a732496c0cd64824648acee794c17ee27c947e58", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457235, "uuid": "8ea4f0bf-3341-4023-a4d2-91f058e06a86", "comment": "Malware payload (Dridex)", "value": "4f1edf7aa865a5017007261aa6b461151c1eb1252cb3a7383c24b3cb6cdae779e6945fbb82990323fb826781484f51e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457235, "uuid": "ff9e2a69-a06b-4e32-b2a0-8ee95422ce0e", "value": "30F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457235, "uuid": "97ec2004-bec2-4289-9196-a12ee76aed54", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457235, "uuid": "ee128bd7-fc63-4226-8d91-daeed299bce5", "value": "3072:3iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:MeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457235, "uuid": "eb4e2649-bb20-44b4-ba70-080e041a26fa", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457235, "uuid": "6451e7cd-ee73-450d-85d2-cd9f2c8db608", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457235, "uuid": "9c7c5cc5-a238-4222-a0e8-a1a1c52b2132", "value": "57721a0b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db714556-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435661, "uuid": "94b05752-237a-4c80-9235-2576a32e11fb", "comment": "Malware payload (Dridex)", "value": "d4b76405cd77336c1f50274379f71971", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435661, "uuid": "26ec994f-c0fa-4611-aa43-7d93f73766cb", "comment": "Malware payload (Dridex)", "value": "2b0142c74ac7d85f6f85a1ac3c4c1975ca450cafb166d982f7c40938b92265ed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435661, "uuid": "415af442-bfad-4790-baff-fc2273574b83", "comment": "Malware payload (Dridex)", "value": "8c1c97ce5330befd70e83afbdcfaac1bd474d585", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435661, "uuid": "be444b36-1674-4b25-a25e-40fd5113798f", "comment": "Malware payload (Dridex)", "value": "963cc74d1e1bb09542237a079f5ca6851ab8867d24aa5458b3d56a5c43c270b4239e4b747eaecd7637e385f20259d04a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435661, "uuid": "38625d6c-2ebe-4daa-86be-09735ef6fb8b", "value": "97F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435661, "uuid": "5e6907a8-3bec-4025-861e-4b5c80d9a965", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435661, "uuid": "991334b1-d4fe-44e6-b3a2-b446305643ec", "value": "3072:glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435661, "uuid": "4d34b95b-897d-4d1a-989d-378366eec14c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435661, "uuid": "0c3542f8-49ad-4d4a-aeef-1163cad8abc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435661, "uuid": "230b13a6-0ac6-48fe-bad2-e60d957415da", "value": "d4b76405_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5857bad2-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "cbc5527f-e4fa-4636-8b09-652058086e96", "comment": "Malware payload (Mirai)", "value": "01b2c70c076920b736f6b02860b776dd", "object_relation": "md5", "Tag": [ { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "5499beef-a3bc-4993-a833-e718f4580329", "comment": "Malware payload (Mirai)", "value": "2b0c7e20b7234c1b1914685be0eb5d4700c580b73c8c8937a9897be9445bf393", "object_relation": "sha256", "Tag": [ { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "8e818087-57e1-42cb-b204-79142d148813", "comment": "Malware payload (Mirai)", "value": "8ed46875d26ddec3dbec7ed9f139a571be217d76", "object_relation": "sha1", "Tag": [ { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "f5109d7d-34c2-44b2-8adb-d64cc6a5bacd", "comment": "Malware payload (Mirai)", "value": "082d1687a3ec25b6ed1c5bf4eef312f4c405c408e13dc4a86790902d2e92a1a53a3dcb46b947138e77d6f86cf72a07f8", "object_relation": "sha3-384", "Tag": [ { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "b826d4f9-8093-4bbd-806c-03ffdbb0374b", "value": "E2631999A4010D5CEDD798BD40695F098E7413506FA30B0BA6ABFDB33DB31A6FF0A944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "f2a93217-9af0-432a-849d-b19d0cd3549f", "value": "1536:XcXq51zXJHvB528S1bizxV14nnut7PZeg1pw1Fk6Pw:Xcj8S1bCN4nnudZHpwZPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475384, "uuid": "163ed959-1f48-40dd-88d8-11230a54af72", "value": 70760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475384, "uuid": "b7b63a0f-afba-4782-9df1-348fd3feea94", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "131c027f-15c3-46e0-aa02-8eb30e0d65f3", "value": "xd.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60da471a-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468097, "uuid": "b47de623-91b2-4e1e-882c-f7dcb087d76e", "comment": "Malware payload (Dridex)", "value": "2f3eb73403aec0171844d906c1ba3005", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468097, "uuid": "afc0dc4b-3d34-4cd2-9401-1f65d0b0e52e", "comment": "Malware payload (Dridex)", "value": "2b2fad88da3c6685b4af7cac523cf20d6f3ae38620802275d8d7eec65164d810", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468097, "uuid": "2aa47061-658e-4777-b747-3cfab0225f63", "comment": "Malware payload (Dridex)", "value": "6bd5f14e697421622dce4f867323364838da12de", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468097, "uuid": "63801778-2366-45f5-953d-961abd95c5c3", "comment": "Malware payload (Dridex)", "value": "89c89438105cec32e216d61db74b3b05bcfd2d060f6048592c3a680f95aab0b91a986e795e7c008501b298d28cb9ef1c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468097, "uuid": "c541f37c-2730-4409-b1e4-964a47af979f", "value": "E6F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468097, "uuid": "b7d50fc6-e89b-41f8-8125-2522370b9763", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468097, "uuid": "52fd79de-35d0-4e55-ae2a-efdc8e45894d", "value": "3072:3WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:342IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468097, "uuid": "5dc0cc98-b60b-4cc4-b2fe-ac9ee41d4ee2", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468097, "uuid": "0ed98df8-1f20-4b4c-ac17-8bb19aba80d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468097, "uuid": "54cd6308-36fe-494f-b1fd-362f6621472d", "value": "2f3eb734_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69724269-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432034, "uuid": "a34104e3-269e-4d7a-9d3a-5e4e2f379658", "comment": "Malware payload (Dridex)", "value": "201a0993c7a99f2263b45f17414a1c54", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432034, "uuid": "5024d6ee-cdf3-461d-b204-02f43007b98e", "comment": "Malware payload (Dridex)", "value": "2b84fc1e52f7e78fccacbcc86a46afa2c33bf981d91f6485c1c12bc96952173c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432034, "uuid": "5d237401-6131-4202-a1fb-1235a918357b", "comment": "Malware payload (Dridex)", "value": "3ca4e1f5e2880bef3fd8f8387224b1e10f319b87", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432034, "uuid": "06eb8f50-70ad-45da-bf2f-e33787cd29ef", "comment": "Malware payload (Dridex)", "value": "06e48b8c8e9fdb3e370fb9ef8c6fda7f16ed35eff0425b85c3ca467c066aeaff94b3b2e9640f1a9c7c61e4363aa8d1d6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432034, "uuid": "f51c35bd-5f1b-462a-9c13-a8ed48c9a1d3", "value": "17F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432034, "uuid": "8a6b22ed-98bf-4ced-9010-6bddb6972f61", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432034, "uuid": "52b0e3d5-7b0e-4654-ba87-e838d2bddb3a", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432034, "uuid": "4f59558f-f57d-40fb-8492-5bc60094ee59", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432034, "uuid": "ba9025db-cf2d-46f1-8395-2e09e662a264", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432034, "uuid": "ecf055cc-e4c0-44e9-b5c3-5b2783c51dbf", "value": "201a0993_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2dbd50-b038-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620504352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504352, "uuid": "fb697cf5-4fca-4033-b7c4-ac807ee5f8f8", "comment": "Malware payload", "value": "3e0a1fe20b2f8ff71a402c5f354b3bcb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504352, "uuid": "01294477-b262-4bed-8fa3-f8f0ead974bb", "comment": "Malware payload", "value": "2c399e4dc8a518eeaf3a32847622fd309482395f32e694ea1c9d13ac60b066c1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504352, "uuid": "6b85048a-3924-46f6-a0bd-2c5fa47524da", "comment": "Malware payload", "value": "c1cf10d696fb93e260a195fc84937a947ee2c51a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504352, "uuid": "dcfe2a8f-7147-4435-8c97-57fccf8cf70a", "comment": "Malware payload", "value": "ee3a2fbbe611a8a5c1aae4aac6a06e906f73ad51cb73b238974941c1dfdb45e474956e8e84482b047e468e0aea519d03", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504352, "uuid": "a1d908d8-4fc8-402c-8406-fe4200156909", "value": "3CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504352, "uuid": "ecb0b114-e267-419f-a3ee-5148c60c5ac5", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504352, "uuid": "426e72b6-ed7b-4491-aa4a-a12475777c73", "value": "3072:nlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:nlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620504352, "uuid": "d949aa03-ec32-4ac8-9c61-9c8a860847b2", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620504352, "uuid": "8ce18cd4-cc22-42d4-8793-80c28941c477", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504352, "uuid": "a421a0fd-05c1-4147-83bf-a23aeaf2f636", "value": "3e0a1fe2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec7ca5a-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475368, "uuid": "50b31b46-a6d0-41ef-bdbb-bd02d6f6d80c", "comment": "Malware payload (Mirai)", "value": "18234b7e9e20fb124432dc89b9c9797e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475368, "uuid": "1965211e-5f5a-4294-b70a-9c57b4363245", "comment": "Malware payload (Mirai)", "value": "2c6e29e714a93bec0f5eb2403cd04000eb164742570bec2e68df19fe7add29d0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475368, "uuid": "a1dfb5ad-8e7a-476c-8bdb-1449cc7a2b98", "comment": "Malware payload (Mirai)", "value": "0caa209101c00c33083b9bf6ef587368d4afc948", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475368, "uuid": "89b68ec6-1f9f-4424-af04-2207e99990bc", "comment": "Malware payload (Mirai)", "value": "8ed189871d873829c204e64c12bbee7ed3426cb3ec4173ad16e9e50169f66a5de3aec64893c47ed3ab206e3029760173", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475368, "uuid": "487e93b1-af4b-4bc2-909d-eb514b1d271e", "value": "A7B3941ABF600FFBECABDC374AA8170528CD651921A97B717934C418F64B25F95E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475368, "uuid": "03e2f055-1c63-48b9-8eee-61f722c6edff", "value": "1536:HRUmedwrHItbLB3Oos9MGuNmPGmdd3ymleZgQEwNd42+qa136o9:xUmedwrHItbL5aMtyleFcco9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475368, "uuid": "4e8544ef-444c-4173-a90b-c0312df29c60", "value": 109368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475368, "uuid": "2c30dd35-1b8c-4832-a94f-f4c7005efb0d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475368, "uuid": "2e9eb0ed-bc6b-49a0-a801-d818a2689a76", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b86150c-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489670, "uuid": "6023bfd0-d186-48c1-8a9a-7b122bc073d9", "comment": "Malware payload (Dridex)", "value": "c01a689d5482b001fc093ddde06e6d30", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489670, "uuid": "582aef5b-6207-4c81-83af-205cd532262c", "comment": "Malware payload (Dridex)", "value": "2d267c02e03fc41ca196ec78a804dfbffd5185b343c009cc67254e613201f426", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489670, "uuid": "4c9ad67a-6577-4bb4-bc9e-aedcacfb7371", "comment": "Malware payload (Dridex)", "value": "ce09c3a7f10362b8e541d10f1a56f046e4f846c2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489670, "uuid": "7822738f-804c-46a6-b77b-c607fb290be8", "comment": "Malware payload (Dridex)", "value": "68ff3d9d6afff05fdb8f04287d9e0bb9dd542ae9824c66067c4beae9d1824f0f35d7fd60b6fe3c82a570d46b580647ce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489670, "uuid": "ac4f0fb5-243b-4cc8-a394-e7bb6449b144", "value": "0DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489670, "uuid": "6e4aa68d-30c1-46f9-bf9e-78a9028fd444", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489670, "uuid": "ef370e2d-7fa1-423f-bab9-3f65936c4734", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489670, "uuid": "59bb2eb7-42ad-4b49-ad2b-666e246f65f7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489670, "uuid": "69a063c2-cfe2-45cd-a5e2-a3b92504fdc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489670, "uuid": "3b509c49-ce5a-4769-b29b-5489576147a0", "value": "c01a689d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa43dde3-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489695, "uuid": "7cdcbd53-5ad3-4079-bacb-93bce1696076", "comment": "Malware payload (Dridex)", "value": "af3e868d417ff14690a903759f304d3c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489695, "uuid": "6113f110-c6db-4a5e-b86c-935c8ea80b56", "comment": "Malware payload (Dridex)", "value": "2d4e5e9c727fd79d0b6c5effe551202397df0a63aaba37113439596edce3e8a9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489695, "uuid": "9f72d845-e4a7-4eac-b553-53982350915a", "comment": "Malware payload (Dridex)", "value": "5f713b72090a22c0288cb37f024cbb1127359efd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489695, "uuid": "7ca67534-3f03-4b4d-9c1b-2e5c68d5f69d", "comment": "Malware payload (Dridex)", "value": "a95a376f87cc9b6e66d663681535618f7d8a304f2c1b3157dbc2df9c72b2aa9a32413dec9f720a4dac8bff98edf78435", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489695, "uuid": "a857b380-1a75-40bf-8024-553a1b4d2449", "value": "0CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489695, "uuid": "775542d4-78f9-4daf-91aa-ae8696323032", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489695, "uuid": "76c0c252-03ae-413a-a1ff-b384b0077342", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489695, "uuid": "ad45a6ed-66f3-4842-bf57-e982472b18b2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489695, "uuid": "cb71ce55-0c9f-464c-aa6e-628414d3fdf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489695, "uuid": "5bf833ce-f916-482d-9671-02100d18c180", "value": "af3e868d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8275ea-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620478958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478958, "uuid": "683919f2-ffd5-43d8-b460-449bd413f1e5", "comment": "Malware payload", "value": "d4786993be2baa72f2144cef99bb10cb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478958, "uuid": "60287603-633a-45eb-b7ab-dce8faee4d63", "comment": "Malware payload", "value": "2d8180a4f0288fe52646facf76a01a50bf7f487e109fe40cc4db8ca56da175c9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478958, "uuid": "0c48c562-10f6-45c2-8712-a85ace2baca9", "comment": "Malware payload", "value": "c0bff1c33fe25d116c692696a3f173de09984888", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478958, "uuid": "0035b775-7cf1-428d-90c8-022304c90d81", "comment": "Malware payload", "value": "87d9e39e92f57278831621d40fa9e1f423f644396569f033942ba79ba4463ec7b1eebccdb76466aaedb994aba3574612", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478958, "uuid": "f274623a-fb62-4fff-aade-a7e11a4f9e09", "value": "4E660184FBA8DE1DC87B4136440AAA31625D4C38CB46C2C7991837DD78B7AF44F86BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478958, "uuid": "0e6b8e54-18ba-4e8c-8353-a96978f740c7", "value": "196608:o62n0TuexIvV6izR1tDidMLfvqIbhEELElLT:o7jjU2zyI+JT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478958, "uuid": "e711e93c-c003-4b27-ae63-4669efaa89cf", "value": 6762836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478958, "uuid": "1ceb14c4-0a04-4dc3-a691-47ebbf509301", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478958, "uuid": "92405dcd-09d4-4d7a-808e-475ad681cd84", "value": "d4786993_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7381d6e4-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432051, "uuid": "ec673c25-5547-4ec2-ae96-9de0282da95f", "comment": "Malware payload (Dridex)", "value": "1b6810db5fc35178bdf0b6fad3ca9364", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432051, "uuid": "c17a0c82-ce62-4966-b4b1-fa0d3c558ef0", "comment": "Malware payload (Dridex)", "value": "2dad7a9ebe12f136a6c6d4d6984124d7ac32fd54248365edfd1af809663420ca", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432051, "uuid": "b0b2aa26-5710-433d-b198-7b1d017cc2e8", "comment": "Malware payload (Dridex)", "value": "50fc58b089e74e2e19bb91370d67b44425961ebc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432051, "uuid": "acac72a4-9991-4a0d-bd96-8438c3f35ac3", "comment": "Malware payload (Dridex)", "value": "145fceba1f63d107a72885efa97c404dd4ac8c93f3815f7df288dc68828cf469911502f8a30906a3b047ba1806e92d7a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432051, "uuid": "2cf2a208-6876-45aa-80eb-83548dba8028", "value": "9DF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432051, "uuid": "1733386f-6272-4403-8f44-bac9e0d78546", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432051, "uuid": "ed3fcd71-aecf-4636-a822-8a9610f92e0c", "value": "3072:eiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:VeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432051, "uuid": "ef803977-ebd6-487b-b23b-f8379b02195d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432051, "uuid": "c0b39ee8-534e-40bd-a33f-848e5ff9667c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432051, "uuid": "e3f944cd-4d07-42fb-aa34-a24680218fb3", "value": "1b6810db_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d511a23f-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435650, "uuid": "9a8fc5fb-e13c-4f53-a4de-89d67bad95ea", "comment": "Malware payload (Dridex)", "value": "996fb00552917bbd2e5c30b438876fc7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435650, "uuid": "e39ce380-a95a-4a6d-b09d-4668f0f7eaae", "comment": "Malware payload (Dridex)", "value": "2e9129109a9654e09a5dd7e7cd9952cf94878e8f6c31942fb5acf65002252114", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435650, "uuid": "2966784d-f52a-4538-bc69-38e584f93c1e", "comment": "Malware payload (Dridex)", "value": "416789d9d8a7a3675e6387b14fd92085eecc469a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435650, "uuid": "505857c4-3dad-4a9b-8181-7e0157b62ce7", "comment": "Malware payload (Dridex)", "value": "1a57144c0d2480e30e9ab88325377cc5d3aea14de8abe18e6897b7ea7837a84426749e0d81a1d887e398f3cc097a1e83", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435650, "uuid": "6725ffc5-eab1-4bcf-b320-a013a6180ad5", "value": "9CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435650, "uuid": "09638aa0-b65f-4007-ae3b-788657f04760", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435650, "uuid": "de281b39-8ccf-41ce-8052-ef4259c4c4a6", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435650, "uuid": "e3a43a2a-1c7a-4006-a591-efc058d22ba5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435650, "uuid": "9d733d6f-740f-4787-ac80-5ae49741bab3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435650, "uuid": "5956bdd7-1571-45d6-a8e6-429f0d05658a", "value": "996fb005_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a507d8fb-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478949, "uuid": "b9c6a531-ca5b-405d-8339-ced906a7f66b", "comment": "Malware payload (Dridex)", "value": "f9f4c19866212c9b98fcaa70fc2b63e1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478949, "uuid": "d6546c75-14d6-4070-bab7-9daa37921009", "comment": "Malware payload (Dridex)", "value": "2ea2534c671be32fee563f3af8d2b402eaf3752ffedd95fea99a6436ff9aa785", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478949, "uuid": "dc3e0b25-eb00-4714-a19f-8ec609894f55", "comment": "Malware payload (Dridex)", "value": "7e6109b79005f0a5c044891717e13a5183af8e32", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478949, "uuid": "10426773-1dca-4e06-a34a-06e6b51bea99", "comment": "Malware payload (Dridex)", "value": "c2dda146b43d17df017fc2256d3bacb968babf1739950e96e8dcafcf1582f7d9b34110782e29197d7f64e821a0d99e44", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478949, "uuid": "a5af07ca-05e2-4441-ad55-6083d58a913f", "value": "66F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478949, "uuid": "2d3ec396-c6d1-4dac-85a8-7314cc0adec6", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478949, "uuid": "e6934be7-c7f2-44d5-a45f-840d218e8e65", "value": "3072:Ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478949, "uuid": "a86f33d0-1d87-4e51-8956-ce9b5422d78a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478949, "uuid": "b84127b1-2d34-4bdb-804d-6250c2dcef10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478949, "uuid": "c4b50119-e4b0-4c75-aa5d-f58326d245f5", "value": "f9f4c198_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5820c734-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "5db782cf-fd8e-4be7-8952-0c52aa9859d6", "comment": "Malware payload (Mirai)", "value": "f19ca9f8c3537d189bd63a5b2968414f", "object_relation": "md5", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "9afb25f3-0948-4b17-a19f-d7bdac592d97", "comment": "Malware payload (Mirai)", "value": "2eaad3b67c6fa40f7909a8b4c331fc091779ee236d4de6367231105477b6538b", "object_relation": "sha256", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "c7fe0025-aa4b-4947-a371-13fb754a507f", "comment": "Malware payload (Mirai)", "value": "db1c70a1159aa3d6ce6270dd5b4f49983bb100a0", "object_relation": "sha1", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "4865b5f1-d4cc-4a02-9cdc-8c1de6721da6", "comment": "Malware payload (Mirai)", "value": "850a1b5deebd2fd3f926c3215fe5392657a4129ac30f042b333eaadb4a8d3c88730746ce7405d0de7a43b2a1485e659c", "object_relation": "sha3-384", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "f1636678-8256-4344-b2d3-badfec758622", "value": "2EF2D06C13076CA4CA7CE3B852F627406EA90FD2A627C5463899DEA3974C0DD3452FD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "a22aaee5-4c43-4e54-9370-e7397742728c", "value": "768:8VRzMCPAkmCQDDDsjGw4SEK0BWIq41FQfKYhgDTKJgGlzDpbuR1JA:86hFDDsGw4SEK0g0FXYhgDTuVJuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475384, "uuid": "57dc8b1c-afd5-4c94-ace4-976217080611", "value": 35556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475384, "uuid": "d76d2d8a-abd9-48f7-8cf9-7c2ef78eb55e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "0714b095-4128-43e9-8419-d913b5219c66", "value": "xd.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9e4628-b036-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620503416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620503416, "uuid": "84b0bddd-a053-4717-9c53-d837e1e76100", "comment": "Malware payload (AsyncRAT)", "value": "4336ba1f6f94127f3610a809151dcf5f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620503416, "uuid": "2082790a-add1-49d3-ba6b-6cd99f2ae23f", "comment": "Malware payload (AsyncRAT)", "value": "2efad23e5eb0e9a7ba2cbe0cc79d97e242047ec89baefe08568c447d17fe8bb1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620503416, "uuid": "581c5ce2-37d6-4483-a487-0bf64c723ae2", "comment": "Malware payload (AsyncRAT)", "value": "a423d5ab7f6b4a107aabd00927872169c97a3c90", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620503416, "uuid": "f9fa1c99-d259-474d-9a1d-1617fd2f3b59", "comment": "Malware payload (AsyncRAT)", "value": "e272f0a4df0413ca1884384d0609bc710f0be7c30283b472c34a21e3a1fa71014eb02dc6ba47e64d8ce4c2e9dc41b7e4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620503416, "uuid": "a1471d53-1ee3-4202-9d12-3c21075d7e77", "value": "AFE18423A3E84677EDB60B329DA2564107BCE751DD67CBAE64C4610E5E173010BA2BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620503416, "uuid": "cb296bb7-79ad-4dbe-9746-178080bdbbbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620503416, "uuid": "e6a4c7e5-f810-4ece-9d23-e75d59813f13", "value": "96:R2d+icOq/yGB+q30rDxL89cB9z+4+xI7MVu3pE8MrfzNt:R0/Axk/xL8CB5p0IuuS84J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620503416, "uuid": "28677288-3eeb-490f-82fe-163ac126a587", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620503416, "uuid": "e6620f37-114d-4bf6-bbed-02e94a9a0d6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620503416, "uuid": "9621f8eb-3962-4aea-a24a-26fb81b7c2b9", "value": "4336ba1f6f94127f3610a809151dcf5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54e56e0-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442872, "uuid": "758fd7b6-3ca5-432e-97b9-127ec7676806", "comment": "Malware payload (Dridex)", "value": "7fd52a97207d13e2df9a968b2c16b3ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442872, "uuid": "cde0c67b-7c11-4daa-97f9-c30d6af5b7c9", "comment": "Malware payload (Dridex)", "value": "2f2369223bed4c568ef91a0c7707636f5aeeec1f19da2668d858a546786f2597", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442872, "uuid": "cfa07fdd-d0ce-4a2e-af10-da8abadfdb07", "comment": "Malware payload (Dridex)", "value": "57d237aa526c25c62d0ac96ac5c116ff94200b8a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442872, "uuid": "523c9b47-3ec8-48f6-866f-d69900b79627", "comment": "Malware payload (Dridex)", "value": "53f7afd873f18be53ff226a1451267745a5c67ffb8fcb60275d7f6fcab653c4330f00cfa47894f01efbfc4e1c61cf9f9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442872, "uuid": "63a6edb7-22af-4cf1-9094-72bb673ce434", "value": "D2F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442872, "uuid": "b30e071f-5e30-41ab-849f-92d583929689", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442872, "uuid": "bda07f79-53f3-41ff-82cb-11b04c1c2e47", "value": "3072:Dlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Dlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442872, "uuid": "17ea92de-00d4-40f0-9358-5a24f23814ec", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442872, "uuid": "c468ed71-6746-44fa-9d46-a2efa57c7464", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442872, "uuid": "ea80e088-37aa-4af9-8118-fdbef2e2d3dc", "value": "7fd52a97_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b157628-affe-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620479228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479228, "uuid": "5dadf7b0-c3fd-4316-9cda-07837a802ea0", "comment": "Malware payload (TrickBot)", "value": "8e20c994daaeeba5e4d70760d73cf52e", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479228, "uuid": "cf100750-60a9-4026-afd4-f15921a25836", "comment": "Malware payload (TrickBot)", "value": "2f3c6660f3aa00ef8039afb3efadfe91abf8cf5b5d6ac000e114e91d636e11f7", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479228, "uuid": "7c337335-824a-4525-94f4-c4240f119a4b", "comment": "Malware payload (TrickBot)", "value": "d06b99a511bbd787ac5aed453af8d64e160816fb", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479228, "uuid": "371c97e6-d81e-49e5-ae03-0f28e371cdd3", "comment": "Malware payload (TrickBot)", "value": "ac58a7706182bdf510e05859d0fa18929a46a3255a5d4aa0ba6d167fb8e6dde16a00e1b656c5c49e6cd41046b9aa8d10", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479228, "uuid": "029267bf-581b-42f2-ab4f-4aef444853e2", "value": "73F4BE02B2D1C177FAE202714FEAEEF7EAF5F9114A295447F3D62B0D19719434A36A20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479228, "uuid": "1a533036-e3a3-48a5-80a0-a89ed80f2b9a", "value": "a854f0696e579de7373340a712e95c97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479228, "uuid": "85244080-7812-4e95-a96a-ece7a0ff5163", "value": "12288:bZfAStuSnRmDuGQ9bNfvz/04ueQlzxE30wIpgfCORMxVB:h5RmKNfbs4ueQhuEZifCqMxVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620479228, "uuid": "28fbe5b3-5848-49a6-a1ee-50f7a084a513", "value": 757828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620479228, "uuid": "3f7a5218-b137-4419-9a94-ae65e8f109c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479228, "uuid": "bc64274b-fee5-416a-813c-e69b2d81612d", "value": "redbutton.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcafc73-aff4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475232, "uuid": "f2854390-9eeb-40c0-b589-0908e772fefc", "comment": "Malware payload (Dridex)", "value": "8b3058636579e4075ff2ed907dd76eba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475232, "uuid": "a009b892-b8fc-40fa-995d-23a219f00d84", "comment": "Malware payload (Dridex)", "value": "2fafdc2d86b0c2249c99b5f84fd30494079fd0cef92f37e3fe26dfad7a41ddd1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475232, "uuid": "62b2d1b8-1e50-42de-9186-8d35aa21f143", "comment": "Malware payload (Dridex)", "value": "7321eac42fe753c95576bdde4391682734353973", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475232, "uuid": "c259d4f1-7237-4598-8108-9c4c3758dacc", "comment": "Malware payload (Dridex)", "value": "f51faf42464fcb842d101a31736bd2eb0a4fc2994e3883f4d86efa33e34ccf7d8a956e0dd2607d835860fe6fcb4c1e97", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475232, "uuid": "e1bc4243-057f-4c7c-948b-3ab85ce9d602", "value": "77F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475232, "uuid": "493cf1bd-8167-4ec8-8a41-136d99b3ddcd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475232, "uuid": "fc7405d1-5ead-4bf1-980c-abe7cca399d1", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475232, "uuid": "ee6ef911-8aae-45a4-90a8-a84a15d81b7d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475232, "uuid": "e9490f46-8798-414b-8994-026fc29d1a51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475232, "uuid": "7c7d4093-6749-4537-839b-17bbf285379e", "value": "8b305863_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f764a65d-b01f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493690, "uuid": "19728eab-b084-42ed-94c4-e46d1e49b0fc", "comment": "Malware payload (Dridex)", "value": "401e06d4dad54e20b09b251b24d6012e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493690, "uuid": "5a7ea501-946d-416e-9a37-d0141201488d", "comment": "Malware payload (Dridex)", "value": "30605c0036de3cc8a909ea8426d145cf63f0b3c74be152932da86f8480edc217", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493690, "uuid": "049a8676-96ac-4f67-a290-880bc755e174", "comment": "Malware payload (Dridex)", "value": "93a3f07341584dc80ecefc9798834fc6edc8c62a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493690, "uuid": "dc3b5e6a-5135-4141-8614-c8fe882cf43a", "comment": "Malware payload (Dridex)", "value": "01aa5e3313c7f5f27290d708a16399fbdf6f95d2e00970517c739a38acfee14371c2059c808f44a4d02c4fe49dcd0a2f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493690, "uuid": "03af4541-fb81-4ff1-ac70-fa6bc351d601", "value": "90F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493690, "uuid": "897df961-28d7-4c48-b451-d48e2857fb5d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493690, "uuid": "7db265c4-9e8f-406e-bb46-704ec95f831b", "value": "3072:4lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:4lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493690, "uuid": "dffc921a-7931-4866-97ab-3fe7d81abe54", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493690, "uuid": "caa627e0-0cb2-4378-8dec-ba01863a6ff2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493690, "uuid": "e451578e-5560-4c8c-bfec-5aad06172e1f", "value": "401e06d4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f71bb3-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489666, "uuid": "558a0dc7-38af-4d80-8300-08a7bf2beddd", "comment": "Malware payload (Dridex)", "value": "bfe4daf3ca07c70a4250958c46ccbfb3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489666, "uuid": "ccd0d36d-f26a-4359-b277-fd78082c85db", "comment": "Malware payload (Dridex)", "value": "327e07bfbae4f3042a6ec8c12a1fdbfef96fc94833df6893938d85d574af3e4c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489666, "uuid": "0263ab96-4f85-4c34-a3be-97c0699a5011", "comment": "Malware payload (Dridex)", "value": "fceb2d3ba2703ae1e42242f14d57b268292a4346", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489666, "uuid": "702ea5c3-485d-4e4d-929f-64465a63d4a1", "comment": "Malware payload (Dridex)", "value": "d5bd4d3212e61aea53c0e3287cff656e12cf5e4ac3e27dc58fa808bbd2c9b167123a417296e70a21bd1470b29cdfee4a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489666, "uuid": "c995a473-0119-4ed1-b3af-5185766fa533", "value": "32F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489666, "uuid": "b8b4672c-aa76-472d-bdbd-1868e5a06581", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489666, "uuid": "661f742d-5202-4b2f-9920-a057658659d3", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489666, "uuid": "f119ce8a-5dfc-4a72-8568-8e63e1923044", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489666, "uuid": "002f443e-9ad3-43d8-899d-144f9d6a3669", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489666, "uuid": "0f5eb599-eae1-479c-96df-12ec2c03eb72", "value": "bfe4daf3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb8e4be-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489651, "uuid": "f4ac84f6-b2e1-4cf3-be26-96db66da9bce", "comment": "Malware payload (Dridex)", "value": "15872fbd432aa07da463ce37c18495d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489651, "uuid": "b5fadbdb-ba45-4184-bd8a-e8f37ec77e0d", "comment": "Malware payload (Dridex)", "value": "3327cfd16cec32e9d29515f098f08228ea2117838a1dacd3900cf0ee0e5733be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489651, "uuid": "7dee0252-ae97-4520-a3a4-9fadf5381a71", "comment": "Malware payload (Dridex)", "value": "4a38cc84f97d1bb933f4eca90cc19380992ea6e1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489651, "uuid": "d44f4202-4529-40ce-accd-3a800f00e25f", "comment": "Malware payload (Dridex)", "value": "341b1891302777f4c48308c55db7750f285fe5201ae94749482befe109f6e8f3deae70fa5ef121bd136ec47118bf0806", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489651, "uuid": "b5e0910d-cf04-4af4-a041-5e6ba125df3b", "value": "E5F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489651, "uuid": "60ccb909-237f-4a0d-812f-bc2fb3bd257d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489651, "uuid": "568fef66-4c59-4be3-a380-08769a0c8a9c", "value": "3072:0lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:0lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489651, "uuid": "49484cbd-21f3-452e-9a5f-725a449fd17d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489651, "uuid": "733237d0-de72-43b5-a54e-dc9f0fa10de0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489651, "uuid": "ea17bd89-3b0f-482f-9a85-13563cf01473", "value": "15872fbd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f93c223-afa1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620439265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439265, "uuid": "7b284da4-54c1-4022-b6db-f45cf3043256", "comment": "Malware payload (Dridex)", "value": "8921898edfa62e565f43071959fda782", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439265, "uuid": "4425826c-a661-4368-a5bd-f274ddfeef5e", "comment": "Malware payload (Dridex)", "value": "34469fecdcb6127860325ce6a803a2d804e605af46677c5a3dca58874a65b9f9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439265, "uuid": "d0555d23-a169-440c-9687-b29d88c369b0", "comment": "Malware payload (Dridex)", "value": "e0cc7c88559bd5d59c2eff0d4c648d75c632e41b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439265, "uuid": "cc355b52-d0c0-470f-9a14-4952889cd9b9", "comment": "Malware payload (Dridex)", "value": "663b220cb141c6ff9ae975cc269af4bd5727e1961cb2cbc0c33286c14b7667f5730adea0cfb8d32ee6bb9e49a7b7e791", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439265, "uuid": "8176393f-0a16-457c-956f-c4dc0f6b11b1", "value": "B3F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439265, "uuid": "d95d3de1-d48d-45d9-8d60-a95ae8ce4c65", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439265, "uuid": "711b524d-b8a7-49ca-a563-1e937617fb8c", "value": "3072:ve45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:24KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620439265, "uuid": "957206d7-ef15-44de-8202-48272a330abe", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620439265, "uuid": "2c90ce78-9e78-49dd-aec6-694f73a3b7c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439265, "uuid": "8f6ef4a9-5a38-425a-a645-ff6e8b8f313c", "value": "8921898e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834310d3-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432077, "uuid": "f4107a69-4972-4563-8f33-63f4c22687e0", "comment": "Malware payload (Dridex)", "value": "f0b613466646edfff6955b107717ddc8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432077, "uuid": "09927375-17df-4e63-a95a-ede43a046759", "comment": "Malware payload (Dridex)", "value": "346f44378fddfdd99a3e59ae602f0b1d3970cfc0cdfb0b6e8aa0d95b779ec1a4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432077, "uuid": "ddd1cdfb-be7b-443c-90f3-640ee10b44c4", "comment": "Malware payload (Dridex)", "value": "a8e8714c15c79606c90e0648f89fc1f735741520", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432077, "uuid": "d77e610c-81f2-4990-9421-204177c872e6", "comment": "Malware payload (Dridex)", "value": "5be449324a3a54c4cdde0483dbaa2fc90cbe6f1c4758117aa4c56f760f776e3c558d0b25f20df630293f3544d3a7e399", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432077, "uuid": "50fcdfe3-19f9-4d64-b0a7-2a92e7307bb9", "value": "D7F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432077, "uuid": "0989ce4e-238d-42a8-8845-fcd7fcc6a443", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432077, "uuid": "ab0753fc-b60d-4ede-9bcc-6bb3bfc454fe", "value": "3072:Qlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Qlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432077, "uuid": "5edf0d9d-d0cf-47f3-8ef8-49862fd69d56", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432077, "uuid": "b57ee95a-e1af-444a-8007-d78114e183bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432077, "uuid": "ea06c783-2233-4ce5-86fd-8b5439576f7c", "value": "f0b61346_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3daf4e40-b000-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620480064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620480064, "uuid": "aea98393-f373-4b23-9761-7fcefc485305", "comment": "Malware payload", "value": "2f2a34a636302002e6b0db1225b023ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620480064, "uuid": "14041002-5e24-4cc4-ad0d-36ed9ab76ee3", "comment": "Malware payload", "value": "34abe88bc1e9dfe7fa77df43c9c9005bbd27843a40bdcd28431ab9dda7527c1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620480064, "uuid": "a67d78a7-e055-4d64-8ac9-5d30e84f902e", "comment": "Malware payload", "value": "965d3526d786026b8141db5285d087477b8e100d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620480064, "uuid": "485f96d9-781c-4bcc-91eb-9e7ab6a76e6f", "comment": "Malware payload", "value": "87520757445de0263169a12d893ff4b6a2fd9ca6f5f547e4f97ab89bd33770564173954d94a91884fb77fce0b23caef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620480064, "uuid": "5ca2b0c1-4b16-4bd2-a3a2-b9aff6efdb80", "value": "EE55335A80584695F6D00F3DAABD44585B5AFEE407CE7E890A81A2F7D84882F4CFCDB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620480064, "uuid": "5de17f40-4179-4e34-b41c-aa208a8d0d5b", "value": "b439a9654f7060b5857460ccf279d22c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620480064, "uuid": "71079b09-0c7d-44ba-97f1-d8be892fc7b7", "value": "24576:jJKisPdQL8F5TXzdxa+mWdn7c127yEJDmi5lYYeKw1jgzHw6:nsiStzK2BJf5lYS+YX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620480064, "uuid": "1d0e4a7f-7e19-4f87-a3af-c76f4d8c4e1a", "value": 1402880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620480064, "uuid": "cff1412a-6866-4675-a0f4-3ed4c894c5b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620480064, "uuid": "21847df7-2a76-47c3-abb2-9ee8d6eedd61", "value": "EZ cheats GTA V.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f589fcb-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432098, "uuid": "b1e93200-55d2-414a-b3be-9022876323db", "comment": "Malware payload (Dridex)", "value": "3107189d7c4625b98bd875b8354d68a8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432098, "uuid": "8072c540-13a9-48b0-a672-26b2cebd8483", "comment": "Malware payload (Dridex)", "value": "3598e76ff097166e2c2d88d7f1467fc2bdd13c8fad2990de1ce34712974d98c7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432098, "uuid": "b9b0b1d9-6125-404b-94ff-673937147ca5", "comment": "Malware payload (Dridex)", "value": "a0c58eb1e0fd50e4f92e61743a569e76f4eab1fa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432098, "uuid": "c74db456-4eca-4a5e-adc2-fb85a1c18206", "comment": "Malware payload (Dridex)", "value": "b1a88ca32294400258be53ed22142794507b5966986c7b4c30c7fc20793f7d81a9f89d7b33552c157982e3b8c88d457f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432098, "uuid": "cdf3eb70-68ae-4cce-bdaa-1d25d5dcf3f1", "value": "5EF3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432098, "uuid": "fe43cb22-9e44-43f8-8104-6216c598a557", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432098, "uuid": "fd0e5878-cfe6-4202-8f3a-b30812885889", "value": "3072:FuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:F0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432098, "uuid": "df0218ef-bb08-474a-bc51-2b96cf317646", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432098, "uuid": "e6247916-4664-469c-9ac9-614c77e68b45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432098, "uuid": "8d1386fa-6d81-49e4-a7f8-80ca015013f1", "value": "3107189d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab2054b-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486099, "uuid": "65db3fd9-6ef2-4c6e-a226-8da9add2188e", "comment": "Malware payload (Dridex)", "value": "69ad05e8651590465ace8c127488858b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486099, "uuid": "80696429-b59d-4f97-ab75-5385d032947b", "comment": "Malware payload (Dridex)", "value": "359d471d53dccdeae423bf16f8e215b3c0b7cad8a6e5d357862f69fa27262c81", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486099, "uuid": "c9c7ee71-67cb-47b3-8229-c6779a936203", "comment": "Malware payload (Dridex)", "value": "907e1c977df83d7c940174e34757e9a0cf4463b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486099, "uuid": "37ecd4fd-1061-4dd0-bc73-dc6fa0458dc0", "comment": "Malware payload (Dridex)", "value": "8d2f20400d822cd788009581cc1f38a54ab9371b3c48dba591d04ced83106a730584ff351f7e881e5939c14d19fb3ab3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486099, "uuid": "2cd843ef-b11c-4eae-9d58-760e779fdc5a", "value": "C7F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486099, "uuid": "43b5d395-4b14-4d8e-9a0f-3a34b3afb259", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486099, "uuid": "4bd38104-772a-41cf-92bf-aed6ed8d0ff8", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486099, "uuid": "91594960-f377-4c4f-8039-7cff32528d72", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486099, "uuid": "fa599671-0262-43c6-806b-e19bc21547e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486099, "uuid": "c8c052f2-a0b2-4a9c-9335-f214cbfd27c5", "value": "69ad05e8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8dac321-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471681, "uuid": "e00f20e1-8f16-44a2-b9fb-1c18880280c2", "comment": "Malware payload (Dridex)", "value": "c61967d4240071064b67c11992a25a18", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471681, "uuid": "b711a54c-5d4a-42df-9dbc-bd8cf28dde53", "comment": "Malware payload (Dridex)", "value": "37085ba151282448353e096d6f4eb6cde06de899490896d3b937051de92e1412", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471681, "uuid": "afde8a5a-9b28-4d66-98f6-a5115073bca6", "comment": "Malware payload (Dridex)", "value": "e5bff1ceeae6dd2e2da615acf713e9de24fd8c61", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471681, "uuid": "702197c2-35fa-400d-9eae-2f3c3b63294d", "comment": "Malware payload (Dridex)", "value": "80a22efd53675f46e14d02f6eecc7b7321db0b3ae405df316ccead22102b766e9528dfd24c21a8f6354835d87dc6d5d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471681, "uuid": "347df73c-3030-47bf-b9a7-1f61600b9700", "value": "BFF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471681, "uuid": "1c8163f0-fdc3-4f4c-9c17-7d069a070a88", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471681, "uuid": "766df138-d9c5-49d1-a317-e14c8d3ef54b", "value": "3072:KA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:K3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471681, "uuid": "6a98c422-56d3-4ed6-8afb-3f28d7376e70", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471681, "uuid": "ad54ffa5-a4dc-40b5-90a7-b6202719aca4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471681, "uuid": "50554385-19b0-40ff-abaf-4dcd15256d84", "value": "c61967d4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df9b588-b049-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620511498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511498, "uuid": "0cf32998-77aa-40d2-834d-0719cf68eb96", "comment": "Malware payload", "value": "2740f90eccbf69f19320a5f20e76e137", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511498, "uuid": "34ddab3f-e144-4ba1-8c78-9b4fb1cf3b1e", "comment": "Malware payload", "value": "3736a687e94ae72cdd3c861e7984f65a678f62a687271d272d44c0c0a65d3d48", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511498, "uuid": "28a810cc-5642-489b-9c7c-f28c71fbf8fb", "comment": "Malware payload", "value": "7011c4438287c5265a45a8ae31ba9c638b5a2893", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511498, "uuid": "b77a5ac6-b673-431a-b89d-7b119c56a923", "comment": "Malware payload", "value": "51b380253d73b0e3cafa42d51bb51d518a309fed31ffc72603ba186ffd630c84be20d3e970655e9b30c33b1c59c1f2e7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511498, "uuid": "8765ab36-5863-4236-82da-2be7b529a7bc", "value": "47F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511498, "uuid": "116670ef-5e0b-40b9-8d36-ec359471b5a4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511498, "uuid": "cf7a71a2-f3ec-42e8-bbb6-068e5b88578b", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620511498, "uuid": "7f8b6960-2e54-4d36-927b-7e76a29c8ec2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620511498, "uuid": "d07df1cb-f7b9-4e09-a94d-0dc1f4e10173", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511498, "uuid": "7cb26d73-60f1-46f0-827c-9dfed086a913", "value": "2740f90e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ef9597-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471669, "uuid": "b32bd273-6ece-4962-87a1-2ad5406ec601", "comment": "Malware payload (Dridex)", "value": "3133f1e4ee55a7df0fa4acfc469dcbde", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471669, "uuid": "7f07c380-1999-4214-b368-9b99e99dceed", "comment": "Malware payload (Dridex)", "value": "386d85eebaea31e0d08fd0a56d25f0c25bfdf3baaefdcbff545aa8d84eb69579", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471669, "uuid": "8f0f9115-1714-49c1-b47a-7406af82fae7", "comment": "Malware payload (Dridex)", "value": "f297e55665e164a6fa271af95449a292a04c02fc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471669, "uuid": "05dc78f9-fa65-4bab-92b4-fca3af435ee1", "comment": "Malware payload (Dridex)", "value": "a9af5632eefb2b172306c9230459b22b54cc21168dd2a8ebf982df71a6976a6ba2a8414d19ee9dabe83df94bc47e762d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471669, "uuid": "68f8f815-0427-4c55-a75c-eee6c334e017", "value": "ABF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471669, "uuid": "41318a3e-33fb-40b7-ae71-f8b08c574b92", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471669, "uuid": "a13cf0e4-4c4c-486f-be27-b7edd35f9c6d", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471669, "uuid": "0fcea847-e7ec-4b41-ab5c-cc8168fd5f4d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471669, "uuid": "4589dd9a-d61f-4d41-9ff4-21c4f999b1c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471669, "uuid": "7ccf744e-9d51-4513-9f7b-6d0750f3eda0", "value": "3133f1e4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe12e71-afbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620451479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451479, "uuid": "a1efedd1-5dfc-4d71-aecc-698d5174f500", "comment": "Malware payload (AgentTesla)", "value": "6eaafeb01db5d27da8e975db6bc2b990", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451479, "uuid": "c30207ac-cc40-4c5c-b920-c489ccfbce98", "comment": "Malware payload (AgentTesla)", "value": "388696a922dad25f592d01a91a2ee4f2d4076570a76198fdb7126c96a3c8d295", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451479, "uuid": "620efbb1-1500-480a-90e4-8d0aa7afdf8e", "comment": "Malware payload (AgentTesla)", "value": "4e78fbebd2fcc85273307f3ea33d939923ffc303", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451479, "uuid": "c9fcb3fa-965a-44e6-9e4d-9da1a403eb18", "comment": "Malware payload (AgentTesla)", "value": "5be6162c7443f49e8bbd63bedd20afe779334111f98c75a064cdc683b46c4072bec1a4b44004c0a33abd95e9283d4756", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451479, "uuid": "1f282de3-49d2-4214-83fa-f2aee24a7072", "value": "7EE46CEC751468F1D35B5C23A3CF1C0782252274B93BAA0B8B60137D5A97E673E3998D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451479, "uuid": "2076a7cd-b720-4764-b8ac-8dfec922ce52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451479, "uuid": "cf9acab6-e815-4a8a-9b56-1b22acfb7885", "value": "12288:ILfnoLLoS60/K7yh01S9Znf8fq4MgaZhJW2ZkVuT7wcNvJB7Bc:ioLAoZ3YWwcJfdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620451479, "uuid": "5aa487fb-4f52-4097-913f-7ed3000ed1ac", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620451479, "uuid": "378fb982-415b-4d64-8115-acb0a5c0d572", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451479, "uuid": "d614dd44-efcf-4fe1-bede-20acc1378ea7", "value": "NEW ORDER #745332.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935fe151-b00c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620485362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620485362, "uuid": "32193798-5b8a-4a09-b067-5e965f5f2794", "comment": "Malware payload (Quakbot)", "value": "d36f24649f440cb0931cb3f2418a09d0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620485362, "uuid": "c011aca0-7ed6-4275-b62c-c1bc20a23383", "comment": "Malware payload (Quakbot)", "value": "38b3ad4fa2d18bfe9e1d04c5fd24b06bcfcaac5f4ac376bfcfba23f45900f9d0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620485362, "uuid": "bae4da75-9e35-4948-8d5b-c39a057b7d67", "comment": "Malware payload (Quakbot)", "value": "61af6abea1cc27c2dff71d90af9e06de191d7aca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620485362, "uuid": "19618ec8-52b5-4d7e-867a-b19084f389d3", "comment": "Malware payload (Quakbot)", "value": "a07deea23bc1d76345c45d39da12da95d0addf63a5fb551811b5d3a5671f01a83912c2d9c1bdec56703836baf16c161b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620485362, "uuid": "bc20eb41-55f2-4c19-a825-e4c4b601f322", "value": "B705BF22F2A1CC37D27326789E4B52646D39BE50F93899862FD41E486F343D13B36297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620485362, "uuid": "934be95e-3305-411a-a7e4-b23ee058b95e", "value": "f8b50da2e330b5dea32ae4760264b148", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620485362, "uuid": "d30686bc-c3b7-41cc-b843-21be3e03a0ac", "value": "12288:+LR2XCmohgp+8RhuxTyAK4X+PAj6iMRbM+bevd6CR/Vr8m+Bz5oKTxeEJuBnitAZ:+FaCz8nAO42HzhVeEJuBPOu+99z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620485362, "uuid": "72302d74-9b51-4d3f-b018-c67992225db2", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620485362, "uuid": "c9b319cd-b3d5-4d49-a02d-f21d275a9ea4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620485362, "uuid": "aeb3dfe6-1059-4644-aabe-86ade76426d5", "value": "Test.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44fcb013-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486089, "uuid": "707dfd04-a109-4dc9-944d-70f094f65a2a", "comment": "Malware payload (Dridex)", "value": "2c393e9a0d9a7265fba062f2a0b66857", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486089, "uuid": "5bad65c1-ff7e-4f25-898b-7c374991b69a", "comment": "Malware payload (Dridex)", "value": "3949176ce5011e3d4bbc46433338cd1728ce7e50dba40290310548e67448c16e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486089, "uuid": "eb3a28bf-ea30-4e33-8b6d-8428279828c4", "comment": "Malware payload (Dridex)", "value": "25e879d1a6c9ea410cfc9acfad548ffa536566d6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486089, "uuid": "861be81c-0aee-40a1-94be-6519e87d89a3", "comment": "Malware payload (Dridex)", "value": "4f70cdef2f15e4846ba8e7aa251ba3fef4da8436246292cfc7b1ff3fe5f673cff71bd5a9c619852ffae81424454c93eb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486089, "uuid": "a85b5bc9-979f-404a-bdbe-82def25aff4b", "value": "AAF3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486089, "uuid": "3bd158eb-a913-486b-b766-7bb98a27b5f3", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486089, "uuid": "e8156544-cee0-4e32-9b62-1d38553754a6", "value": "3072:LuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:L0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486089, "uuid": "1c7fe01b-c9a2-4051-b48c-cceace29992a", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486089, "uuid": "cb9bdbf6-cc64-44b2-b8e6-af77c1ecf3b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486089, "uuid": "493607dd-c65f-4d7e-bb34-12e8bcf2eee4", "value": "2c393e9a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622aad98-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468099, "uuid": "d438bf8d-94cf-4ba2-a2ca-db4d79d44830", "comment": "Malware payload (Dridex)", "value": "d2bcdbfa8058978e7ce8b95b195448d0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468099, "uuid": "6c90839c-11b0-4ec1-80c9-8286576e99f2", "comment": "Malware payload (Dridex)", "value": "39a54a347c47349806d2a3cd885e97c7a728c6998b61a472352a2a8fe6807c20", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468099, "uuid": "d3aabfcd-5b5c-42f2-aa24-5adf4c4cbd9b", "comment": "Malware payload (Dridex)", "value": "ad6f606ce6b45185fa09480879aaaf002602badd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468099, "uuid": "f29c878d-187f-4250-968a-027ec6b09cb6", "comment": "Malware payload (Dridex)", "value": "9b08ce2b7424198de21ae3bae18b5d116aad84beb33b82ef861db25c867bca0ed92fc32de8ad9bad6b80623d3375635f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468099, "uuid": "78b7745b-67ba-45d5-9ab9-aa3b89f7f3f2", "value": "D4F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468099, "uuid": "610ea82f-667c-49fb-87c0-645170986470", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468099, "uuid": "63393659-763d-4ad3-b865-790a49ce6933", "value": "3072:rA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:r3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468099, "uuid": "e8e651ba-0a0a-4ca3-90f0-c0671ee84d86", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468099, "uuid": "929b990d-7c20-4deb-a581-56e453ef1eff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468099, "uuid": "526e2aab-f268-4eb4-8417-724568be4f78", "value": "d2bcdbfa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4884d15-afdb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464453, "uuid": "9e6e919c-4b59-49cf-bf05-032bd35ced3a", "comment": "Malware payload (Dridex)", "value": "2705a89ef8b88d806edf55623e03aa04", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464453, "uuid": "4ca05f5a-2aac-4f0e-927b-833fbc8d5d05", "comment": "Malware payload (Dridex)", "value": "3a6877e35227974001cd77ff6e419380a6e5734f43bff6f550a48951575b2d87", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464453, "uuid": "151ca2c9-021b-4b24-b3e6-4d412b626df3", "comment": "Malware payload (Dridex)", "value": "7c6fbc34b7f1bd2b85e032556d98f17cc44afe82", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464453, "uuid": "b7d065b1-9365-48b8-a295-1643f4ccde6c", "comment": "Malware payload (Dridex)", "value": "63cfedc3de609e961eaf76ea0726b3deabd83712aa744f264b2f0c1ace75600efdce798062b5af97df79905f2142d08c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464453, "uuid": "700904f7-272d-4710-9676-3511f91de5d5", "value": "BCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464453, "uuid": "1f4ee5f8-32ea-42eb-abb0-ed3594792568", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464453, "uuid": "c7542472-db38-4a1b-95e4-b25d0b4549b0", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464453, "uuid": "8136ae7c-4e06-4cc2-8c53-0f0ee0e8e84f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464453, "uuid": "b23a0ffd-21dd-432c-9cfc-c2ea8ec57977", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464453, "uuid": "bce3ac4c-ea28-447b-8b0c-4bd0d1eaf54e", "value": "2705a89e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55722622-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "a50ae125-f7d6-4e77-86f7-9f2594649a57", "comment": "Malware payload (Mirai)", "value": "dc253f8b95b06615cd0c58b8db4ea2fd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "99ffaa20-7747-4f29-9515-b7eb490b8b7a", "comment": "Malware payload (Mirai)", "value": "3a6c11483492ded75d51ae19dde95293a6c34b6ea85382add9a5fe4c7c72f9cc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "8a0f727a-ad75-4172-8322-d798918e2ecc", "comment": "Malware payload (Mirai)", "value": "a6bb6adf36f1d6dcfa7571d139800170af39b4e1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "d0e5dd25-f398-427b-bc9d-1d63b077e7de", "comment": "Malware payload (Mirai)", "value": "719dbff5bf7333ddc26a8171248a8490c9569a8218801dbec17a235b50ba136576962dce74cefa6404ba1c591b441d92", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "e048014a-2949-454e-9535-d7826d8c08e8", "value": "C6836A21B83A2B07C0E1A57F22B74356B2F5274E26B8CA5E7CB20F4EFF1525025475B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "de67dd74-29a2-4237-8573-ec681a31d0e0", "value": "1536:id1oF+/yDTnguAeuYJiSRy2ja5zOJSck4UVknxLSdYm+qaC3j:5JtRyya5z4SckoxyIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475380, "uuid": "116f518f-36af-4dae-8288-297c9d9f5515", "value": 85040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475380, "uuid": "96a8ed63-ec04-4acb-8b44-ac99bb89d1af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "9be9da4d-6a04-4c3e-a92a-a67493283c9a", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd06b46a-b038-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620504383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504383, "uuid": "95f7cb8d-4e3e-4343-a013-637558d2df69", "comment": "Malware payload", "value": "838248dc98126792fff17598d826c305", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504383, "uuid": "fc837280-2448-4b66-92ee-b36461cc2c57", "comment": "Malware payload", "value": "3acf0d9f712080e7c83eb9da3c128c6e06b97dd47d234e2f2670e330d92d983a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504383, "uuid": "711fd81b-1c1b-48c4-8523-38bae3bd456b", "comment": "Malware payload", "value": "00cf6a58590305ad416a6256db8cc492318105cb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504383, "uuid": "07dd6604-745e-4d02-b86f-b970abb267d0", "comment": "Malware payload", "value": "ae19ff41807146b20180fd7eae03b9e635ce266bf5e810a5e230ccdca417f04c38ff3be1dee9b6fa30d31c59fb3bc9de", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504383, "uuid": "a8e96add-af42-40e1-ba13-350fd70ee376", "value": "1FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504383, "uuid": "c3db911f-7fa3-42a3-8749-d5a7319f00f2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504383, "uuid": "928f9967-9711-4ec9-88de-d14349f3953d", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620504383, "uuid": "9504c7ad-977d-4d98-a019-69a6041fe5c3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620504383, "uuid": "c15abc01-d531-43a7-b813-952fa9293085", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504383, "uuid": "d79f20eb-7931-4875-ac7b-6461219facbc", "value": "838248dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a28eb47-b020-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493829, "uuid": "c3d65891-49f2-45e7-ace1-81043d2ed390", "comment": "Malware payload (Dridex)", "value": "96b36913e1cd02adcc09571ed5401e60", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493829, "uuid": "1d5871fe-5095-4e67-97ba-c98220ca5034", "comment": "Malware payload (Dridex)", "value": "3b519a4a6757dab62603afaf32e142515911a6dfadf7ca5fcecc607b0da9f353", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493829, "uuid": "ab6a083e-9870-43c5-a0e1-75998ca80b87", "comment": "Malware payload (Dridex)", "value": "e1ca3faa5e283852f64d59d6cc72cac8a082491b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493829, "uuid": "24cfa13a-251e-4611-863d-80a52cf7ff96", "comment": "Malware payload (Dridex)", "value": "d104b5edfa447e120e620faabb75774b1751a56784e6a50f3f286f24432e1f93afdeb1990a1898cfd8802b65b0302f33", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493829, "uuid": "ea4191c0-d130-4550-b536-617bd7ef6017", "value": "C1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493829, "uuid": "0c77f25c-548c-438d-8404-712a51117c46", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493829, "uuid": "ce09e5ed-c3f6-48c0-9bc7-91366b9c6149", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493829, "uuid": "b9ba8f0e-fb32-4eef-9920-0b5d2892706c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493829, "uuid": "ce875ebf-b5dc-4152-bb40-7a1925e45431", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493829, "uuid": "eb5a4997-7778-4d5f-99a0-5c1794a4fe25", "value": "96b36913_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd698ef-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475367, "uuid": "0965eb54-b325-4312-ac20-88fa64c4f856", "comment": "Malware payload (Mirai)", "value": "a6c97d6133e27fdcc0a4f0a860ec4a64", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475367, "uuid": "94809d7a-5d4b-4dd6-82b6-2d24e3f09f3f", "comment": "Malware payload (Mirai)", "value": "3b639a3db8d163cd311f255584464a634beda998b047d721e03f3f41f49349e1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475367, "uuid": "d55f8ecd-1666-454d-a2c6-6c8278fb5d95", "comment": "Malware payload (Mirai)", "value": "338c4aaf2e55e6a4f9056a96b0b312d3c93ef008", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475367, "uuid": "3db8c550-2a5c-4011-96bb-9627fbe7cf3a", "comment": "Malware payload (Mirai)", "value": "bb4a31c40432b20d805ccecc3e6568f38f36c721a5972dbb1ca6b9b5cf7138f19d15c8160f3e144f449311894073f8b4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475367, "uuid": "398464cc-ce2e-437a-8053-877f17f93fe9", "value": "02832AD6F8014DBCFD6BE5BA45220B0DF52173005F631F2B566BFDA32C632A9AE06941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475367, "uuid": "1d8673b0-634b-4225-9c13-b57a90913ad2", "value": "1536:Z4ww5t+HRvXyipfIC+hLiKhSSMLLYS8TlLSyhEewL8+TvA:dX/pf6vLMPiJ7AY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475367, "uuid": "445b60a8-c379-40fa-8cee-db5f7fab23de", "value": 80740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475367, "uuid": "eebd686c-df97-4360-b1b9-687099e866c7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475367, "uuid": "a8fbda2a-fca7-450f-a2ac-75939e2fe0ea", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c47b03-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432081, "uuid": "9ed92544-47db-49a9-88c5-bf105bf8e177", "comment": "Malware payload (Dridex)", "value": "7fd413b5dbf9cd2f9e6c2c352675f6b0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432081, "uuid": "827340d8-3b30-4986-9588-2d508905923e", "comment": "Malware payload (Dridex)", "value": "3b938772d489b3c3fe66c5e178a2f776277507463ae52a191aa51de1fbca5eee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432081, "uuid": "5990f60c-9a09-4c5b-9a70-70467ba59f2e", "comment": "Malware payload (Dridex)", "value": "f47fc04a83fa2cd2eb794abb17c449d6b0d0c9c1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432081, "uuid": "32cdd476-4305-4267-aded-fe40cce4bd1a", "comment": "Malware payload (Dridex)", "value": "6dcb04c52e2de09b823cab0942afc96018ad5042420ef5dd4e6085ed0df0621b6b18ec21fd2909f47918180a4b00fccc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432081, "uuid": "15687206-92dc-4a78-b30d-c8520bfb4f0b", "value": "8AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432081, "uuid": "6dc98b44-45a2-4df2-9933-6e809ead8f28", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432081, "uuid": "1e6cbc64-8c38-4bd6-8141-c85e540263e5", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432081, "uuid": "2b65c9da-6068-4247-999f-f069b3dedd05", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432081, "uuid": "15e29d43-ead6-48a2-8f9d-447b092d8885", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432081, "uuid": "5cf0da86-2b38-4e67-8cd2-121e2d9fbb1a", "value": "7fd413b5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a4ea9a-b027-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620496935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496935, "uuid": "78f3498b-a547-4240-b939-be592abb4553", "comment": "Malware payload (Dridex)", "value": "eed1b97bc3b303237691612c52f8e003", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496935, "uuid": "436d8241-10cf-4b79-bbae-8dbb5ad42d85", "comment": "Malware payload (Dridex)", "value": "3bac087ceb5e8940c55d5c3b83bf2f7292a488f1c847bbdcf1ab046832386b6e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496935, "uuid": "0fe2c96f-847f-4ba5-a857-6572c43f662d", "comment": "Malware payload (Dridex)", "value": "2dc21050426404b4a4ae370fb536f4c2520fae03", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496935, "uuid": "c80310cd-a5e4-46f3-964d-b76161ff3219", "comment": "Malware payload (Dridex)", "value": "168ee31c61edffb01e8d277275123626b39b000a590db844f695c0fc12c8e6dd34627500339b4efd35afb77ac1de7bbd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496935, "uuid": "5524ba51-1b08-44ea-90fd-e050997ccb65", "value": "CE33D1B0A51C2CC5D5F04AFC2A6CABD1EB883B99E373A493695CB49D278134335C5CB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496935, "uuid": "b82dcad8-e1bb-4d59-ae51-22bf7f7a5074", "value": "768:7ghafWHawQpapwt0y6PENQrIC4k5A9Cwy16/2CxOqxHZbmdC3/zIgEJ9ZY/7m+2d:75WJECrIpOV1m2MdPbOO7mL+Nu1TTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620496935, "uuid": "c7b36a72-2fe6-43e1-a816-5c4ca807bcf2", "value": 50606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620496935, "uuid": "9a3c3db4-ca91-45f4-953b-e5fac9590d13", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496935, "uuid": "d7e99453-9e18-4f75-adc0-fe8ba80efcdf", "value": "generated order 1353692.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b6a83a-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460905, "uuid": "f70c39c8-6154-4f3f-b6a4-0bb0bcc7982a", "comment": "Malware payload (Dridex)", "value": "70824472ba3cd072cec2fc97a199bdd2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460905, "uuid": "245c182c-b996-4af1-b30f-108dc437eae5", "comment": "Malware payload (Dridex)", "value": "3bb028572069bc12233f4ee0313a53409a16a301813316acf55b0129e620977d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460905, "uuid": "6db467ae-2bf3-4817-9743-5133d0b60b1d", "comment": "Malware payload (Dridex)", "value": "078abfaf8e57d338f151f7380e6429540bc60dc0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460905, "uuid": "598e2f2e-21b0-417f-b760-c81a72f10262", "comment": "Malware payload (Dridex)", "value": "5ac380dfce0233165c9a531f207633267f45fe97076615a91e8d20883c28212d7223bffad2dac85697811677f70748c5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460905, "uuid": "0a31d74b-ab71-454b-a4ba-7a626cc549ff", "value": "A1F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460905, "uuid": "e03b27e1-e6c4-4d53-92ae-9a6a0bd000ce", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460905, "uuid": "6480824d-f864-4be9-9bf9-4399beb3cf09", "value": "3072:QWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:Q42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460905, "uuid": "619b248b-7e06-4b81-b80c-908ac6f6a45f", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460905, "uuid": "a7d4472f-eee5-49dd-85a0-c78c920eed1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460905, "uuid": "0e796d22-ae24-4fff-b46a-568a1a59702e", "value": "70824472_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce140f3-afb5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620447904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447904, "uuid": "b8597c85-3ed6-41c0-9e53-0264817f1572", "comment": "Malware payload (Mirai)", "value": "f480422b7c66e1a7f782d15f1cba314a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447904, "uuid": "9f1f6b13-8ad4-4499-8f23-54cf18bf8701", "comment": "Malware payload (Mirai)", "value": "3bff9d6e17a47471196723065f9d5c931749c064714043bdcccca166adf69b71", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447904, "uuid": "a7fba713-0dc0-41b8-a912-435bd900176b", "comment": "Malware payload (Mirai)", "value": "111260defff296aeaa2321c5c3a5d60237b5983c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447904, "uuid": "5455bd5f-ae24-4ac6-8ae1-972608c18036", "comment": "Malware payload (Mirai)", "value": "3881d9a44e6c18c666741cf753e257009e2cc22ab44650db2d8866a2c003b4149c705e36b320acd59391018c774e2a19", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447904, "uuid": "9119a564-8c35-433f-b66f-bd8321810f02", "value": "9FE2F19001CA0F7EE24EC1713DBF345E4A2065386B09B43763DD8ABFDA21F666A0D803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447904, "uuid": "f3466e10-9c8b-4872-ad0b-2ac1518c692c", "value": "768:FV7uGL7IAcIKGZSj/Rqtd/4oqEx7dwUbrTp9cnbcuyD7UryqP:j7uGLEAFZi+AO7rcnouy8mqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620447904, "uuid": "1ce52d56-96c0-41f2-8e25-f6a5ee7c0e3e", "value": 31784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620447904, "uuid": "adb888f1-74b5-49d9-9352-ae1013f8b993", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447904, "uuid": "3f088626-e589-4fca-9904-655bdb3e9b82", "value": "I586 (1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55898b44-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "e0ace5b8-9af3-4279-bea8-bd17ab83ba3a", "comment": "Malware payload (Mirai)", "value": "329be09ba1b0a79af25e948d0c79d38c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "688c9162-0d07-4342-980f-bd95fdc0b5a8", "comment": "Malware payload (Mirai)", "value": "3c1b972051ce934b635fedd46669ed486587acf20f3cd65bf6ddf6e60ce858c3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "dc7343d8-cf3e-46ea-b9a5-be2583809fee", "comment": "Malware payload (Mirai)", "value": "a9495d70e628938debeb27af454ceaff320f1a5b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "99fdad26-1d78-472a-b7be-af0169f081d1", "comment": "Malware payload (Mirai)", "value": "ff6c080e3d6a34f3e67aafbd4e2bce8e8c7017b94a579f315bf34f0b39a517a456cabf70ff27eca204a7e555ef98e384", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "37380a43-1305-49f8-8d69-92766b314500", "value": "7F537C66D4B85DA4D49849B0761CCDB49783A404AAD33FF1C683CF694807AECF509BFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "94bd8c50-691c-42d6-a0cb-c69fbbc4fbab", "value": "768:6/BAQypMoaeH5GqqwB4NmNcHzFlDIUDiPV44g5N2tS7ajtjL5QrKv0QD6in3kS/T:6/2HmoaeIauBtzESGj8YU9PG9ACcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475380, "uuid": "89dfbc8c-f43e-4ee4-96d9-f76073f69e30", "value": 63852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475380, "uuid": "89138440-fec1-42b2-ae44-b8d6028abc3f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "78483479-0a26-4339-ba04-03d8dccf2b3a", "value": "VoIdHAnaAW.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9512d2-b005-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482503, "uuid": "3ec4fe4f-7482-432d-a475-8f44a9cb2d06", "comment": "Malware payload (Dridex)", "value": "3c1c359497e2f159d0416c68897049a1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482503, "uuid": "ea45fe80-c82a-4065-bc01-8dc033515fc9", "comment": "Malware payload (Dridex)", "value": "3c276803c1d67903bcb81a31ac89bbce876891cd01f97991f51cb2a42d72041e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482503, "uuid": "8561c7c5-fbd0-44e4-b77c-5c122a2258fa", "comment": "Malware payload (Dridex)", "value": "374cc12b0c25deb2a3044a3bc1c9425b28af7a63", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482503, "uuid": "3a62ecc9-a957-4873-9346-d8855837f35d", "comment": "Malware payload (Dridex)", "value": "df217f5ed0591e03c79c14f22b9af786699e5e1704869280ce951058688e941304b1631baed0581213ccaf5549e325f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482503, "uuid": "d4aef473-f8ec-4cf0-a2ee-d34bfdeede71", "value": "C5F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482503, "uuid": "3fdc242e-28cb-4a0b-9140-c6a0f377108c", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482503, "uuid": "d945127f-4d9e-4a5e-a52b-f63550f33a5e", "value": "3072:fiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:UeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482503, "uuid": "00c0d0fd-e53e-4591-b411-e69a5f0931c4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482503, "uuid": "0fab6bbb-6fd5-4a2d-aaa6-daa2735e9e55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482503, "uuid": "fc2419bb-ebfa-494e-bfc2-0613fc065e60", "value": "3c1c3594_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66dbf62-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442900, "uuid": "2bf19f62-458e-4552-9284-b2b8379d8c21", "comment": "Malware payload (Dridex)", "value": "c9ed32808c5c89718828fb8be0ae5775", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442900, "uuid": "00a70593-d2f0-487c-a50c-e110d62b1f62", "comment": "Malware payload (Dridex)", "value": "3c32e2a9bc8762f7c6d85825ae94d87ec012a215a88c301d95c16871a2a2799b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442900, "uuid": "5fdb1902-09b2-47e1-9e3c-64e2ea7d1153", "comment": "Malware payload (Dridex)", "value": "98903f0fb93afd8b0cac846888885b85c505aa2c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442900, "uuid": "4d86105d-8160-402e-9d72-ed068973e587", "comment": "Malware payload (Dridex)", "value": "4d76acc1c4fb9ec591e7b7b06f4c0b24cd1ffdfd3240f1de311395330a4dd51ad1023dc2c617d3fe4865f089c81b0cd4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442900, "uuid": "25defaed-fa45-4302-bcd3-4944992b1d69", "value": "8FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442900, "uuid": "2a9c8e0f-41ec-4f03-8bca-1d72c9c92efe", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442900, "uuid": "7a1dc667-5377-4959-a4c7-55403f829c4a", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442900, "uuid": "03f42bfc-b791-4d3f-8df0-ffc0dd62ddcd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442900, "uuid": "904a90af-326d-4c69-a7e8-ac11e64cfd2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442900, "uuid": "dfeba1a1-1710-4a06-9b67-16bc2228ecd1", "value": "c9ed3280_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b19faca-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457323, "uuid": "6c1dceb7-141b-4bd9-8189-36a8e3930b5f", "comment": "Malware payload (Dridex)", "value": "9d8e3a767965068a5609bdc6721e26c1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457323, "uuid": "294b7e5e-f400-47a3-b587-190e34da7b15", "comment": "Malware payload (Dridex)", "value": "3c33021981dc4bec9616cb874ebc542bbf97da3a179ba44be2fd454ace4a9309", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457323, "uuid": "47c6ed33-24d0-4119-b51f-f8e404f08fee", "comment": "Malware payload (Dridex)", "value": "f79065ba63a0641eb580c1fd507150cbfe10061f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457323, "uuid": "71776356-9e12-45a2-a866-bffccd614c08", "comment": "Malware payload (Dridex)", "value": "9cc9d9b45675fc7f716832c42d6bb1a6f61825cc40626f537cb36d9c891f521c151f98d143f73df0fbe776168251477b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457323, "uuid": "7a4ff94c-bd3a-47fc-a064-080d1659d2b6", "value": "53F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457323, "uuid": "b8e5535e-b850-40d6-b550-68d01b2f67b3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457323, "uuid": "468b3f5a-214f-4a6f-aa04-4fef3b6339ed", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457323, "uuid": "15e6c356-1fc9-4198-a156-2debd9ea33b2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457323, "uuid": "04d1936c-230d-44b2-bbc4-e49028b6cbc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457323, "uuid": "89d0110e-ef70-4ac2-bbe1-6654d770a52b", "value": "9d8e3a76_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6083fa2c-afba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620450058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450058, "uuid": "e33864bf-cb98-4ca2-8dc0-155968c9ec63", "comment": "Malware payload (Dridex)", "value": "542bf22c584a9621b4d8368771451229", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450058, "uuid": "89d2b3a1-b536-438a-a26d-652fc3984294", "comment": "Malware payload (Dridex)", "value": "3c4a3367517b0c085f11d424822ad646b748015c4eaaa2ca4e615b38ca0183b1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450058, "uuid": "51737bda-a529-469a-a979-a79028388e88", "comment": "Malware payload (Dridex)", "value": "64e486f0109d0eaf664a49d0118aa46845e57251", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450058, "uuid": "5cfa702a-8dce-4a5b-8b20-ab8a6e4fdf3d", "comment": "Malware payload (Dridex)", "value": "ba40831a4223164ce57541a09e60ec6d46e440f38a0dda70b1ef6cbced0aa4b2ca1c4b4890c20af947aaf1a8b8135696", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450058, "uuid": "685551f3-72a2-4d93-b1d0-6cd29dedd5bc", "value": "7DF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450058, "uuid": "6196f3a3-a81c-4b2a-866e-f25ffc9ec5b1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450058, "uuid": "df5d4511-cad9-4fe1-8a84-0d6279cc05e5", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620450058, "uuid": "2fb02b40-8631-44e1-ac7b-e00915269043", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620450058, "uuid": "cf8f5d12-1c47-43ac-8387-5a6cc6e9cb5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450058, "uuid": "e1d34cc4-b336-4ebb-8aa5-476758cae723", "value": "542bf22c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84122400-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489631, "uuid": "63a81842-1c76-469b-9022-e98a649fe7b0", "comment": "Malware payload (Dridex)", "value": "50f97951ea7c64e35aea968d686b5d6d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489631, "uuid": "f9a55050-739c-4f5f-8b12-10de8b1a3be9", "comment": "Malware payload (Dridex)", "value": "3c6ad06f1d622349d14fb9be759296719830257af396e5973e163db3566bd892", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489631, "uuid": "156889af-fe55-4324-a646-1a5f3ba39f42", "comment": "Malware payload (Dridex)", "value": "8fd3d3b7c8e7f15443b541aea9997ec8344455c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489631, "uuid": "312fec3a-d1ce-4a8d-82d5-1aaba95917c0", "comment": "Malware payload (Dridex)", "value": "23f3b6a3f061354160866dca046342ed6f5468e37e05bcebe6e882d36e67b9a8c9d058be141cc78b64079f934434387e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489631, "uuid": "40c87ce0-8ba1-418c-9e4e-0a4ec54e82a0", "value": "C5F3C141C9C5CCF0CBE36C3A4695963B3228B541995A8E42EC64CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489631, "uuid": "8201db37-612c-4136-9543-b5b8510382f5", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489631, "uuid": "2eba0e76-f470-4c91-ab37-991b0f7f065a", "value": "3072:SuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+HY:S0czbty9uiaJlOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489631, "uuid": "e03d0b53-32b1-41bf-87ac-33f38662225b", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489631, "uuid": "f967da95-f8fc-4b1a-830e-15f1791a23d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489631, "uuid": "ab3f077c-5696-48f7-9d05-4a90e53c6330", "value": "50f97951_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e0e56c-b020-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493840, "uuid": "b2d03a4c-d121-4a5b-a36c-e77ebdb30fe8", "comment": "Malware payload (Dridex)", "value": "9531dfcbc3eb26e57a5ac296ae9ea2d7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493840, "uuid": "ec5686e0-576e-419d-ab4d-d7b6f543e840", "comment": "Malware payload (Dridex)", "value": "3d352121ece618cb82495d9d75e9fb3fe12e09f55ca095e4caadf85d664987b6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493840, "uuid": "96ced521-32bc-4c45-90d2-1b96faab435b", "comment": "Malware payload (Dridex)", "value": "fa3cf3d052e262d9ae2db57725c10f929a2244df", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493840, "uuid": "a7d055f9-6574-4c29-8e32-345bc9461b90", "comment": "Malware payload (Dridex)", "value": "eddd6ee2e4c1e311400c8f6e21f14ed6a96f6a5af4e2894d1641e3520abba7b459c15cf64f8668d0df63784e2ffcf29c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493840, "uuid": "47ced0ee-2de7-4b34-8aa4-0e099338cb8d", "value": "A1F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493840, "uuid": "678fd1b6-4a79-4e7c-a559-1d99cc5c87f3", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493840, "uuid": "6b053f5d-54d7-4ef2-902f-605adf2e902c", "value": "3072:4iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:DeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493840, "uuid": "4257f855-2118-4735-bdad-87932e977fb6", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493840, "uuid": "713c8894-bb59-49f3-abe3-158408c143f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493840, "uuid": "e1054f81-d1fc-4728-a7f9-bfd3533eda19", "value": "9531dfcb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494d32dd-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468058, "uuid": "4bb3bff0-154a-4596-beef-482c9545b534", "comment": "Malware payload (Dridex)", "value": "110756883caa81a5bc7dd38f4984bb72", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468058, "uuid": "727c9702-656a-4b83-80fb-bb68f9b32160", "comment": "Malware payload (Dridex)", "value": "3d5204e19194c94fd0bfe8a1d25884f0c54a723382f1eb11edb1bf06c26fa2a4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468058, "uuid": "03b8761f-5746-46a6-b075-853581b4c5ea", "comment": "Malware payload (Dridex)", "value": "6c0a87cc5b97a03ce3ba45a291afc6e7e312b5d9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468058, "uuid": "2aa6a432-e3d8-4445-b59b-008681ed09e4", "comment": "Malware payload (Dridex)", "value": "378149ee37e0fd50196b89a25d4c106c115729d0ade609a0eac4faba666793a65aa6db0abf339feead6a5aa766759220", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468058, "uuid": "c6086e01-513f-4971-b494-1e68592c0a4f", "value": "ACF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468058, "uuid": "e8ad99a1-5f79-43da-b3c8-d29a489da4eb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468058, "uuid": "896f3bc2-7901-498e-b7e5-027a90ebc41f", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468058, "uuid": "3642209c-c58d-4f82-ace2-06c0965cdfe7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468058, "uuid": "e6b7ba75-6473-4f7b-b7eb-59d36a7ded31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468058, "uuid": "13e364b6-df72-4d26-91af-a135cb8ff2f8", "value": "11075688_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ce325c-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475436, "uuid": "c68f80d9-d95e-499f-b33a-6b9654f4b46f", "comment": "Malware payload (Mirai)", "value": "9fbb44013c187839198c5792f81d6ad4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475436, "uuid": "2a7d5857-1fe2-4bd1-af2d-c7307889e3b1", "comment": "Malware payload (Mirai)", "value": "3e2bd3909c91a4ffb478b89b16bef39182e2ab0b91054bc97d9913262b1fd783", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475436, "uuid": "377605ab-7133-45a9-a0a8-0bbeec2bcd8d", "comment": "Malware payload (Mirai)", "value": "0ca882568f57b5ee529972a655f4b7818eed158b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475436, "uuid": "87bda590-52f1-400f-b5f5-5ded702176be", "comment": "Malware payload (Mirai)", "value": "637344efd3888eda1eff7156bdf734590d469a5e10881a797b1010eeaccf3412b6240c9c21ab4238804516742900ce04", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475436, "uuid": "12807d3d-93c5-4a9e-958f-27d64b815eed", "value": "E6735B24A97A2F26C1D4A17E62FBC321F1F6230E25B4961C3CB60F8EFF1465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475436, "uuid": "51fe5a99-48d5-470c-bb53-ab21712a5759", "value": "1536:ubHmkTSo3BOIqS5aq+Dc035R9QuEk6vNNicKzfnFx8:kmcjaq+Dcc5J+vN4FzfH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475436, "uuid": "9d469134-3f3c-4842-b6ee-1f34d199d6f3", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475436, "uuid": "ed680f80-29ee-4ef8-b8b0-20db0dfe74fc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475436, "uuid": "c99d8a20-11d6-4930-8043-4aeb882536f0", "value": "xd.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ec9bba-afca-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620457095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457095, "uuid": "b70d85b5-507b-40fe-96c1-e7723a05e7e0", "comment": "Malware payload (IcedID)", "value": "d638bb6f51dafa75b869555059676c92", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457095, "uuid": "aaa88d6b-81b8-480b-8dc1-83db7e4bbfe5", "comment": "Malware payload (IcedID)", "value": "3eeb025b4103aefe9ef71b82ef66e3b097e1aa6778f461fd63ef8599f37b95a4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457095, "uuid": "c74c085a-f843-4c6b-879b-f4970bad2b1a", "comment": "Malware payload (IcedID)", "value": "66f70011c9591fae214f1c9cc4b045ca2f66e615", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457095, "uuid": "7f12fe62-4da5-4c23-a3db-041dc9160d5a", "comment": "Malware payload (IcedID)", "value": "36af5582d83af5c1de598a2fb7668798ed5109bc593a35480fde9a68f04075ead14df2d2d4e11ba8850b816e23d6a686", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457095, "uuid": "91973b3d-30c1-41bc-8cb3-a4eec2857cc5", "value": "35635DCA05700B22D5365672C5B31B28C27BFB40B7D368FBD19C7698C5C2180D772DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457095, "uuid": "ee2d59a3-7ad9-49c7-b589-1cb1aea293a5", "value": "768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457095, "uuid": "16795847-1171-4da8-aa7d-09609190c86c", "value": 67504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457095, "uuid": "4aa5c880-9270-4ae9-ba34-6b6ff21a5534", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457095, "uuid": "a3082695-2cbf-4f33-be44-236ff049ef64", "value": "d638bb6f51dafa75b869555059676c92.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc277a3-afba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620450077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450077, "uuid": "deb8e526-2dfd-44f2-86cf-65a91c0cec0e", "comment": "Malware payload (Dridex)", "value": "be2fc9fa71b58dc7d38f30969e25a6f7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450077, "uuid": "8bc53002-8406-4bc4-a963-364bd9a5b12a", "comment": "Malware payload (Dridex)", "value": "3f9b22e46e55fa465a7731e37e6e22481e066430b3538c9ee585185d4e49e0b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450077, "uuid": "8bc09b46-25e2-46d9-afcd-54181d6a51c6", "comment": "Malware payload (Dridex)", "value": "9f00809d324efd4592f016eed0cce2b48f72dbd2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450077, "uuid": "edd90cc3-257c-43e3-91f4-17fbea057795", "comment": "Malware payload (Dridex)", "value": "083a6ece7bf843cced1f8ef4af244a86dcb9e7c3267ec66caedfad51048966bb3a1ad02884b46da39eee756743c41706", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450077, "uuid": "e731767c-fe3c-47fc-a288-43c99b9d7c43", "value": "B2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450077, "uuid": "b4c20af1-eda8-44bd-8a32-97571028d198", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450077, "uuid": "9c6b4449-5f84-488c-a45f-07f12ae62ec5", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620450077, "uuid": "77ba30d7-00f5-4353-b367-20daa1d2b4b2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620450077, "uuid": "b7c8528d-8924-433a-a0ed-2f21d6807754", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450077, "uuid": "a857a92b-3793-4cc1-9b13-9ea4cc9c0b6e", "value": "be2fc9fa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd059852-afbc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620451072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451072, "uuid": "2cc9eec7-f2e2-4a03-bea2-4ae9c8f0525d", "comment": "Malware payload (AgentTesla)", "value": "16a2e60be265343b6b55e16110d5633f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451072, "uuid": "221d9e23-1edd-44b3-8bb0-fff70aec5a14", "comment": "Malware payload (AgentTesla)", "value": "3f9eb1d67f5f85ad76dc28a3fa3112459d7bb614ff177cbd178ee1035649da15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451072, "uuid": "acf6af6c-38e0-4d4d-9c1b-e72343458edb", "comment": "Malware payload (AgentTesla)", "value": "069d18a147fe2c689b6bbb17875dd2037e517d74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451072, "uuid": "4c17f303-0217-406c-8121-0ca8827d6673", "comment": "Malware payload (AgentTesla)", "value": "65f815cc7a513e34166ab69ba27e3a159f72de9d9d556ded54b6c06c42f042544cb5f8be0acd0ccfb24854ef575d3696", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451072, "uuid": "1bb51c45-1dc2-4c4c-9e2c-ee26ddedd09a", "value": "5FC423B0625F96BAAB401898C07AE339714787AEEC7FF356D0D3163CF7498236419A4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451072, "uuid": "d17d5a62-dc9e-4974-8266-9e8e76b4c3a0", "value": "12288:YUZO2Lnr68eZBSfaxPxoG61UCiB7uR7cneytCtw4S:pZp6pZBto3w7uR7Ye1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620451072, "uuid": "ae3d64e0-eb49-4971-aa8e-a5d50c74ccb4", "value": 561801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620451072, "uuid": "b349961e-ac12-44e5-8325-7dd33ff88d32", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451072, "uuid": "90ea5a59-23bd-478b-bebc-283c13d33cf2", "value": "SWIFT COPY FOR ADVANCE PAYMENT.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa87d534-afb1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446451, "uuid": "f30158b3-cbde-4a75-a5ed-c7bd24f94038", "comment": "Malware payload (Dridex)", "value": "553ad980ca977a78ceb48b178d509847", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446451, "uuid": "06c1aa6f-1d49-45b2-93c0-419c0d9aba2e", "comment": "Malware payload (Dridex)", "value": "3ff5706e75ebc5770432b2510469e9aee21e1fd599440b526616a3174e56d672", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446451, "uuid": "b10ac7bd-e1a8-4a78-bb11-00a2ec061710", "comment": "Malware payload (Dridex)", "value": "da6722c152196156ff2077758e7111694c814e7f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446451, "uuid": "40d0e4ac-1d54-4d7a-ae59-e18e133f3a70", "comment": "Malware payload (Dridex)", "value": "e4794a87ad173be41b978046965983cf99b3b788ef351b6ac06101014feb148911f912971b5d861ac419facae82f50e8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446451, "uuid": "c0f499d5-4681-426a-b5c1-c88f40cd70bd", "value": "46F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446451, "uuid": "f2c6a17b-04ce-4bbb-a898-8d6f11b991a6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446451, "uuid": "6fba4ad5-0813-4026-8332-2d2940586310", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446451, "uuid": "3b6c67cf-4313-4d14-b62c-40c01b43a48d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446451, "uuid": "963873f7-912c-42e0-8ce2-40c246bf7fa2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446451, "uuid": "0204de61-9542-4f81-ae9e-68549f5429b6", "value": "553ad980_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bef71a2-b034-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620502502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620502502, "uuid": "4e69b0e2-e684-4987-aeea-b8d88c90943d", "comment": "Malware payload", "value": "cecea707f61b1b80461258dc9934cb8d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620502502, "uuid": "111ede4f-922e-43e7-9cbc-3f79f00d6537", "comment": "Malware payload", "value": "3fffb3c52121210995e11b68b6892df762cd11970f9ec2f672f8718fe2cd79ac", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620502502, "uuid": "dad41d64-ea2a-4ad8-8fcf-6c8295f4e497", "comment": "Malware payload", "value": "c6488de5588ea9252774a97fff22315fc0e9d3c9", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620502502, "uuid": "e3fa0eb8-ae09-4b28-993d-55c4e8834abf", "comment": "Malware payload", "value": "f701a19d11786bfc3bd8213ac22d8b0c0088558fdbe7495b639027535d1aecddfba5c79467d86e6e76d003e69f9b4a3d", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620502502, "uuid": "8f16e5d4-7303-49da-ad20-b5a9a6cfac48", "value": "A1F433D5A0C6B46FB627E36ADD971BC2015301C6B5754E403DA22AAAFB83CD4DD2CC6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620502502, "uuid": "a8f4f8db-6d63-4f1d-84fc-b6f015d0d525", "value": "12288:oEOJSJ916aUcFtoKe2+/aW2EueXrO2LdP30VlpBFTheLIRnSjORFI:oEIK91TUcFtteeQrx5P30T7ZheLaxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620502502, "uuid": "f280bdb6-c47e-4894-86a3-499624d537c5", "value": 732643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620502502, "uuid": "8f31d5c4-1fab-46d1-b84c-f1a86538f9e1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620502502, "uuid": "568be30a-1ce8-476e-89a4-d2e4ad7238a3", "value": "REQUEST FOR PRICE QUOTE - URGENT.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b6fe45-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442849, "uuid": "f617e407-0ae2-47d4-8c82-2723bde185d5", "comment": "Malware payload (Dridex)", "value": "6d15f06927ef73a0cb383834fdc63109", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442849, "uuid": "6bd106ed-3d61-4a11-9e4a-eb2c613fbb84", "comment": "Malware payload (Dridex)", "value": "4050ecd7a2b34a4cca2b93ba5d6b729251a92cc26cef11879ca3fc49297f1f27", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442849, "uuid": "2547ba8b-6360-4dff-8adb-2af2b8e6551e", "comment": "Malware payload (Dridex)", "value": "503f20829d63b3d557f3538d091bd05f55f36634", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442849, "uuid": "dc42f467-36ab-406c-8c63-6aba3eae0ea7", "comment": "Malware payload (Dridex)", "value": "4cd56dabc1a885357d05fea999aeeea4e6330a51e2b63e58e63261491ddaf9f173920591cd40e6c458ccab34186bfbbe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442849, "uuid": "8ccb2977-564c-4fcd-b46d-924994c12846", "value": "31F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442849, "uuid": "7efbc697-54ad-41a0-af57-759e74d80047", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442849, "uuid": "7c85b06c-a7d5-42ee-a647-3e33b524a062", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442849, "uuid": "28e2fb3b-68ab-4a4a-ab66-6956b9029cc3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442849, "uuid": "06b3a442-3cb5-47e6-971b-494c8d641d9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442849, "uuid": "7ce86037-d73a-4f58-87ae-d5574135d1dc", "value": "6d15f069_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a110561b-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442865, "uuid": "89269518-981b-49f0-bc43-a346bb122adc", "comment": "Malware payload (Dridex)", "value": "85dcb5da8496cb65106cb5410bc44e5a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442865, "uuid": "5606cdc1-7e42-4597-aca2-e02cfbbf2f72", "comment": "Malware payload (Dridex)", "value": "407421fc1320e63c1508e297a926d6ec7220ca1fe4ef31be2ad16a55232582be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442865, "uuid": "a1f2677d-dc32-4292-ab87-f5649276b72b", "comment": "Malware payload (Dridex)", "value": "a226e72534a0fe9e1a77d31255482b122f9e0372", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442865, "uuid": "ca642e61-6517-455c-b37f-b31aa9883382", "comment": "Malware payload (Dridex)", "value": "a4ebd8ddcfcdeb96e7595e36f093a714d2ae1c184c64f9c24682a782e726c2bbd31db6f25b7122edecc8b53e03824749", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442865, "uuid": "a414b467-ce21-45fe-ac90-a07fc5a75e2d", "value": "7CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442865, "uuid": "032a857f-4d86-4320-b711-40c8a84478d1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442865, "uuid": "77c91a12-2db1-438d-878e-76bad370719d", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442865, "uuid": "e0b6ef2f-774d-476d-8395-2c37710a068e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442865, "uuid": "732526e1-4d49-4326-8d81-bbe03ce8dc75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442865, "uuid": "5d7c896d-7838-41ec-80ce-94a01ae8705c", "value": "85dcb5da_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858f61f2-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489634, "uuid": "0b48145a-4fc8-4ba7-916c-af4b69948cd0", "comment": "Malware payload (Dridex)", "value": "b6b14a1c20ff3a9eaf94394211701494", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489634, "uuid": "f3678a1a-e58e-4d94-87ab-53a55be7689a", "comment": "Malware payload (Dridex)", "value": "4199252b0a1cd3963c811d7743009aae169b3ff2b461ec4773bdf875d7f04d74", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489634, "uuid": "d6e06aef-c17a-4d46-96ca-803d1b576cd2", "comment": "Malware payload (Dridex)", "value": "8595e1cda7a86456b329ba3a356c79405d738ec1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489634, "uuid": "c9ad3b9b-4851-4a8a-96ed-0394ec9866e7", "comment": "Malware payload (Dridex)", "value": "8430a627a56f4dac38d529c27de475f4e3510fd68aeb550bacefccd388ae564d20ad322f3310340ca6be6f367d021e6b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489634, "uuid": "c6a43aeb-ff19-4129-b3ba-40db4fc63c1f", "value": "59F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489634, "uuid": "9f45b274-1bd5-4a6b-b124-860dad23d9af", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489634, "uuid": "64681fae-39eb-4bc3-b5a3-623a473aca1d", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489634, "uuid": "462491db-73c9-4eb5-ad1d-2f329b9dff02", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489634, "uuid": "cea88e57-0bec-4877-b7f5-904e1ba7175e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489634, "uuid": "40b4bc4b-5296-4d69-9765-9bb6ce9aea96", "value": "b6b14a1c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ad8e6e-affe-11eb-abe1-42010a9c0039", "comment": "Malware payload (DanaBot)", "timestamp": 1620479170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479170, "uuid": "a8624dce-8160-4021-a3c6-fb52848da81a", "comment": "Malware payload (DanaBot)", "value": "ca3a564e2dbaa4c15296d982286f9e19", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479170, "uuid": "3512f3e7-cda8-488a-a737-efadd96078f8", "comment": "Malware payload (DanaBot)", "value": "41b87704118429cf10614b868b6a0ebc3f3d85d2b154ee83101f01661636b4ee", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479170, "uuid": "f6513765-c718-4479-a38f-976369580e09", "comment": "Malware payload (DanaBot)", "value": "e1aaabaf8e2e0e1709b82bcc9427b36465da2ce1", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479170, "uuid": "060e6cf2-3509-4fec-8f46-aaef3327a4c2", "comment": "Malware payload (DanaBot)", "value": "8f93bc5788458d54b947bc0e5bbf7db9e16568332c9b6698da9435f478e4aa0530846a639f80f7718478d3b9ee8327c6", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479170, "uuid": "a05ca20b-56a6-4316-8376-f39ec73234f5", "value": "DC563311A652C131CD781EF104A9C7369D9EE8325F191E9BAB88277DC7281E3F736349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479170, "uuid": "aad8b525-2dc3-4833-b3b4-2831ea871d46", "value": "d74462f62d585085448b55e915d2732c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479170, "uuid": "fc92d5d3-ed33-4dbe-8e60-361831e7899c", "value": "196608:fCFFIiudstoCeqjGd6JDnpNIf0paBgPN1xi:KFFIiudsqqCUpNIYPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620479170, "uuid": "d8b45eaf-2542-4478-84c9-1ebe384fd189", "value": 6394368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620479170, "uuid": "defb5794-b7e1-4d93-8cd8-f942ce146e2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479170, "uuid": "2ec4fd3d-4435-4e6c-b2cf-61474177a8f3", "value": "cvhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65600624-afef-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620472829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620472829, "uuid": "4c3b316f-93a3-4089-ab3a-c46b8fd2d1e3", "comment": "Malware payload (njrat)", "value": "ed4f6f0c18eb8c4a688b729563d324d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620472829, "uuid": "b435f281-4560-48f7-ae20-b5cc7d9f27e8", "comment": "Malware payload (njrat)", "value": "41cc25a64df343891e141dce4a12abff19ffbffa4eec8aabdb9d3141389ae78a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620472829, "uuid": "06c5f55e-9ebc-4f80-be01-72d1af957305", "comment": "Malware payload (njrat)", "value": "73d6cb99af7840afaf55eda97e2711eb8f0087a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620472829, "uuid": "5d9ccb16-0ce8-4259-8fb9-d6b9f52dab53", "comment": "Malware payload (njrat)", "value": "2b9edb589971143cfc3486a739fc2b0949a472eb182db4a761786a2b3123c009a707371f54a9cc399bf8c1cd0439775c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620472829, "uuid": "4434f681-ac56-4bc9-bb62-87d5a8d6ecaf", "value": "E4B21B4E3FB98856C5AC17748AA5965003B4D1870423EE2FCCC550CBAFB3ADA5D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620472829, "uuid": "36617b79-c58b-472e-9983-62ab49149d1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620472829, "uuid": "6df52531-3bdc-44b0-a8f5-0a6ccc5490fd", "value": "384:VxweXCQIreJig/8Z7SS1fEBpng6tgL2IBPZVmRvR6JZlbw8hqIusZzZwO:VmLq411eRpcnuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620472829, "uuid": "68598ecf-5a23-4d30-b944-04d464e9f755", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620472829, "uuid": "6d17f0b9-8019-4afb-ba36-30c2a107e257", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620472829, "uuid": "249a71ec-1495-47b8-9554-5b5c443c32d3", "value": "ED4F6F0C18EB8C4A688B729563D324D7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac507eee-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620471660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471660, "uuid": "b0b0c35a-ece5-477d-81d3-b36efa49a04c", "comment": "Malware payload", "value": "543282aa6f2fe1058b2e78433838c07a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471660, "uuid": "9b3e8d77-212b-4826-83ff-2af88804c63a", "comment": "Malware payload", "value": "421057220d271d9178f581883323d948db3fbabdcdff91b46327300e40f6b7fe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471660, "uuid": "96f30b43-f838-4e15-ac76-fe1398a5c40d", "comment": "Malware payload", "value": "56094255bd16b1270158c2c28803aa60bb7facb6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471660, "uuid": "6d097093-9b7d-4494-8c13-7e68c84908c7", "comment": "Malware payload", "value": "d64ec47598ae48c307beae20a3958d1cf5138e1a9ea929cb2d5c190e5672f0786546a06b511e6b17df308ec3cbf4ae1e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471660, "uuid": "39941a30-400f-41a5-9691-85c5cc61c171", "value": "B3F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471660, "uuid": "381877d0-1691-4919-9d49-64d4b2134d14", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471660, "uuid": "8c22337b-abff-4741-ba08-ce987a8d0a90", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471660, "uuid": "9514cf9d-73f1-4ae9-9e1d-886c65fa3aa0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471660, "uuid": "e8d3ec63-fcae-440e-95ed-637286ff607d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471660, "uuid": "8fd9b73b-0fd9-476b-ab94-527547d1d49c", "value": "543282aa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fae7ea0-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478913, "uuid": "81a1f723-9357-4bae-b0d1-fa575350fc5e", "comment": "Malware payload (Dridex)", "value": "04511bba6d3fc5d4e3e4f3b596988147", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478913, "uuid": "c433ba48-f92e-4014-901b-2afe1f7ed61f", "comment": "Malware payload (Dridex)", "value": "43db76f97a9cdcf7068dd10f797932329c75dc03630abe8dc719fa4d3bd360be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478913, "uuid": "2a34ef87-66c0-4a69-8fb1-0ce266308c56", "comment": "Malware payload (Dridex)", "value": "af6fb1a4db301c1f4077de69a7c15523c5159738", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478913, "uuid": "06faedc4-7dac-4233-9028-b2f3a3cb9093", "comment": "Malware payload (Dridex)", "value": "345a307ae7422a5f62cb4b3f19493ec493f99f81e348550164a9f98c228ac0e05b7044f7fc130b51cd20096ee7e38968", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478913, "uuid": "f0edacdb-65d9-4402-8174-aca975edfef5", "value": "8BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478913, "uuid": "43657193-7b43-4a37-856b-0193c6d5b8d4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478913, "uuid": "2a5ea82e-44c2-4827-bfe5-d9b3eb01f4bb", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478913, "uuid": "08b9f5ce-2b53-41b4-8422-88fe33154f35", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478913, "uuid": "12d3d564-5575-42d1-b2ff-f8c6cb8c0ad5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478913, "uuid": "e74a5408-6304-45c5-908b-c9638b83a368", "value": "04511bba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f921dfa7-afb1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446448, "uuid": "9dc3706c-071c-4fd3-bbd7-0aa5bc7135f1", "comment": "Malware payload (Dridex)", "value": "60a775e535115910ebd1269d58018c22", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446448, "uuid": "5d2ff80d-7e53-4085-8399-fd87988ab712", "comment": "Malware payload (Dridex)", "value": "452ea29523758006a4c0ca0f3ccc2baa7c45f85e257303aaca21e6798f074661", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446448, "uuid": "fc91c2e6-1aa3-4a44-a94a-a96efe83f36b", "comment": "Malware payload (Dridex)", "value": "e3387f0bd038fc6928aae50bf2f1a4470292868a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446448, "uuid": "8547b3fe-71b5-48b3-843c-ff6fa8f2895a", "comment": "Malware payload (Dridex)", "value": "cab1a0df9d7c75f4bfb109935b4adf5b6a0dfcc3638da12dbed86b19b0eba5d28eb153bf1cc8d68555823a3d47a7c767", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446448, "uuid": "2c77e018-6290-4416-9e9c-46e91e79c624", "value": "84F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446448, "uuid": "9712905c-5694-4269-8de8-526b5231e276", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446448, "uuid": "b1cc5715-3da3-4ad6-b568-05746bb064c7", "value": "3072:nA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:n3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446448, "uuid": "99f1c617-ff67-4f71-b366-08414c5aaa62", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446448, "uuid": "189f2cbe-a993-4d82-af91-44b4c5f770de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446448, "uuid": "a661d003-f60b-4694-a03d-6b3fb0831c53", "value": "60a775e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4403d370-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468049, "uuid": "28ddde64-cd4a-4741-9db0-884358cc58f7", "comment": "Malware payload (Dridex)", "value": "91813b4ce4e3336583b2abc5fa8a8df6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468049, "uuid": "f061a5a4-5d1a-4193-b640-56aacd39092b", "comment": "Malware payload (Dridex)", "value": "4626685512f5fc916357f2482b6b11f3cf226788484c07cea338a76d4815b3c0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468049, "uuid": "0dba9747-7974-4893-bbe1-5df93884ee30", "comment": "Malware payload (Dridex)", "value": "b26ba9a27fa60daf677b230bd0f8d4d3da00be9f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468049, "uuid": "91eb77da-6de3-43d8-8fb0-59b9b4c7e4f9", "comment": "Malware payload (Dridex)", "value": "23f6f26b3d844564884d4a3afe55c87b8d6b3c64b008ab81a17b956819756ada4aa9d5bfa5d44de14d114d31ee4d0e90", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468049, "uuid": "a96e8005-aea3-4bff-a313-dcd82139f786", "value": "60F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468049, "uuid": "fbc79edb-a863-4fda-8a33-1a67425d4677", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468049, "uuid": "0284bf76-c530-4de7-929e-e86d5c43547a", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468049, "uuid": "9cfd3f73-6a01-41cf-bf7c-2786ce8a78be", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468049, "uuid": "cc6199c8-0b28-4d8c-90ad-619a932686cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468049, "uuid": "75f25fbf-d225-43cb-8134-69dc764518b0", "value": "91813b4c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261650e5-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486037, "uuid": "ef2b8e84-07b2-42a9-aa66-bd94f3bb71f0", "comment": "Malware payload (Dridex)", "value": "3fd63e05a291cecd31715bb745d36652", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486037, "uuid": "ae3571a4-5a49-4d91-92df-4be79f22ae18", "comment": "Malware payload (Dridex)", "value": "46f28a4dfc49515c4314f25796f0bfc78138abf455f80806043a8f5f61692fac", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486037, "uuid": "b9fe95c6-cd09-4e8e-ab93-a364a8adf67c", "comment": "Malware payload (Dridex)", "value": "527d0bf07d66b3f9d44be25d5efac4ded85be033", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486037, "uuid": "c10830a9-8ab3-44f3-bf9d-618ff6170ffb", "comment": "Malware payload (Dridex)", "value": "5645398c7a7ed0d8386688b7713192d3157fd8f26a29bfc1601d632e3fbd60d17c99245029099d50d1f319bcca4ed527", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486037, "uuid": "abb3987b-df59-49c3-88c5-c5ba812fdfc5", "value": "BCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486037, "uuid": "c7f617c6-c488-4149-8360-e4f019544f00", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486037, "uuid": "508918ed-a720-489d-8750-dc8076081fd6", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486037, "uuid": "bdc01e83-0e37-4003-87e0-8fb2e8b20e4c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486037, "uuid": "61c4ffd0-0c6d-4551-92cc-f2f09ffe0b35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486037, "uuid": "5a7bdf92-cfae-4c1a-ae37-4205dc00fde0", "value": "3fd63e05_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e726ec1-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620475368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475368, "uuid": "55c012e4-52c8-41a2-8053-e5dbd648572a", "comment": "Malware payload", "value": "1ebc1c0dceeb5fd9abb3bc25cf1ebb93", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475368, "uuid": "094591f2-bfa2-4a45-bd8f-40e627c38791", "comment": "Malware payload", "value": "47448ffdd5da5f63b2449c74f63429bafac8f81c59c066ccb590c1e7d5c855cd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475368, "uuid": "7260ba2a-2642-4e27-b566-5b5dfbabe941", "comment": "Malware payload", "value": "fc2ec1277057f1ebda3d2187844b5e8e89fe6e30", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475368, "uuid": "cddf7ba0-3a9e-4828-855a-ea7b5ee38be7", "comment": "Malware payload", "value": "9b27bb20a5e3fc78e2dd0338b96d6cb9a4c908be4186aaccf5368a2c7fe92faafd2d4eef5b41a1ccb78977e4220adb50", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475368, "uuid": "3dcfefed-e8d5-4dcc-bcb8-d96866073e05", "value": "DEF2E1AD84ECF804E97D5DF4611C23B9DA9032CC701BC39DDBE14928EB9664378B9C69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475368, "uuid": "11c6c2e8-96d2-44ad-9633-8908ead5941c", "value": "768:+OFJ62jckyoadNQK+1j/RhH3xkmRr0qFkaXj13E65WRtrtR:+OzDjcpJQKq/X31rNFkaz1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475368, "uuid": "a055c3dc-c25a-45f4-95fa-22bc773f2fbb", "value": 37568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475368, "uuid": "0941de5d-5d7e-4e25-bd5b-90c5915afb1a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475368, "uuid": "dfbb946b-cdbd-4742-9bd5-82a6deeb648f", "value": "MIPSEL(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a3d353-b003-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620481529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620481529, "uuid": "dbbb3713-646f-4d2f-bd7d-e7f17fc6ed44", "comment": "Malware payload (RedLineStealer)", "value": "a425a6b8a7f840048996e0b45e186274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620481529, "uuid": "c1bfc5ed-ac3f-4c4b-8c6c-a9cfe81d0b34", "comment": "Malware payload (RedLineStealer)", "value": "480a4a455f9d876946822d9d43fef8419ec0e6b3faa96a6808a60546ef0980f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620481529, "uuid": "f4007876-59e1-4bff-9036-1b2d13098bb8", "comment": "Malware payload (RedLineStealer)", "value": "bcf5ebc64352c7b8dd5680edb60914c2c21115e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620481529, "uuid": "a6b968d2-db24-4de7-8844-bf52cebd1445", "comment": "Malware payload (RedLineStealer)", "value": "4377796e3e0f3cc5e4e433ca779e1dd99b28ef37e4667aef153cedafd589c168a3212ecfc39bfa8dcf6f68af837dfcff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620481529, "uuid": "a1bb824f-1f24-464d-89be-f81315a89f31", "value": "D894D011B680C475DD5314768C11EBB08E5E786516221ABF7BDD3EBAEF382D1B62230E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620481529, "uuid": "68cdb8f0-f921-4219-b4ed-1995c36a915e", "value": "229d85caa4a32f0682bca8d22f161759", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620481529, "uuid": "e5086e07-5eb8-4a92-b226-3e9d14de0b6f", "value": "6144:vQvJmSueLHYtZ4q1BaFvtkS9vDrPWQW1VhezvdnbW+eshBHywAV+8:vkJmVeLg4q1BaxeShrPmnedyz4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620481529, "uuid": "bfbc1ff2-3e14-4a85-b178-42ee73514bf2", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620481529, "uuid": "e6f3f379-6c53-4a86-9c06-7b984762775a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620481529, "uuid": "22c75c43-545f-4c81-acb9-defc87b72a7d", "value": "a425a6b8a7f840048996e0b45e186274.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57853ff1-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "9d70831a-d665-4bcd-8f85-c47facdecd64", "comment": "Malware payload (Mirai)", "value": "d786f213b286dca66777af6e2dc358b8", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "bbe005e4-2869-4238-8030-7723d1ae3990", "comment": "Malware payload (Mirai)", "value": "48426a4de162ee85e70765639a0d0861b74c9ce236880f9dc5494821ad22f5b7", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "ac6a9ee0-1a68-4b4d-9d48-7a14eb092516", "comment": "Malware payload (Mirai)", "value": "5605dd7a6d6a8b76a9d30a754da47fe5aba18258", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "0d3392fc-bd32-4352-8e5b-a8ee2da2a8bf", "comment": "Malware payload (Mirai)", "value": "a7348028588857215a644f036e9dd467a98cbce79c250e96988a7312dadfb1628591dd12f03b778c1f8a4aa62e9b4205", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "1af2fb3d-67f7-456d-86af-5aaee24dcacc", "value": "DEE2E1A1EB18ED11CB242C35A9B483CB73672935F1D712B57BA64E289FA134230796C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "9233aa44-0636-4bdd-9ace-47c509951b4f", "value": "768:rot/RVKElPqIbCsfncCxUB2LZzuKNdNYdyXvdHCoTjtkBs3Uozr:uRrlfcCxUkduIbYUw/szr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475383, "uuid": "25011469-9fab-48aa-bace-fb9fe9786535", "value": 34096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475383, "uuid": "c04c4e2a-4007-4028-9c57-557a3b6c8fd3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "d61c2a4e-b04a-4005-b482-6b901f02d297", "value": "xd.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc911b8-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460871, "uuid": "f93090a2-d517-4ccb-a0d2-78334d673000", "comment": "Malware payload (Dridex)", "value": "bbb2fee8713ad325a67618547b6327a4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460871, "uuid": "3720dd73-47f9-493c-93e5-76d50773dbe3", "comment": "Malware payload (Dridex)", "value": "485e9d47ac71363a11f7d468ffe19858b8f32ee8331dd36ca479a10d3573cedf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460871, "uuid": "004535b7-83c4-4957-827e-29739c07aa27", "comment": "Malware payload (Dridex)", "value": "8a2fc8896802fceb346cf9fbaec06cbd43f8082b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460871, "uuid": "cdda67ee-5c29-4f52-8999-3c09f6b2cb1f", "comment": "Malware payload (Dridex)", "value": "0c11aecfc84cf75943693d74d43e7afb5db1c61f1b2188f9bff816b5a22d379d98f7a15b22b5f44605fb84ea88806f24", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460871, "uuid": "f6e07f76-d7b6-468e-b40a-aeebb31d7bbd", "value": "E8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460871, "uuid": "a52fa853-5d38-468f-bb15-69da694848a7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460871, "uuid": "50bec0b8-e5ed-436a-93b3-5210c8e9b4f2", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460871, "uuid": "6cbda490-abba-49ee-9907-429613e5fe6d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460871, "uuid": "f9d16670-c5de-4fac-a0ff-fe6d07573009", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460871, "uuid": "2add5022-9a4a-42c0-acdd-9bbcfd681e35", "value": "bbb2fee8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42aac290-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486085, "uuid": "5fa13919-31b8-42f5-9005-ed5bccc7d1de", "comment": "Malware payload (Dridex)", "value": "0ddb1761fca0d53b8043c7da35e1ec91", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486085, "uuid": "5df75921-2e28-4d5d-8378-b24f2a0ccc84", "comment": "Malware payload (Dridex)", "value": "493f443b8b5e2dd6b34d6fda16640f0eadb0b58304bc61aa2c8de3d8aa2a189a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486085, "uuid": "4c741901-16ba-4920-aa93-fadbd98f428f", "comment": "Malware payload (Dridex)", "value": "cbd18ab5f016c0100a45c6cb1ed71181bbabc64c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486085, "uuid": "305ba91d-f29f-4ecd-a818-4cf127240b43", "comment": "Malware payload (Dridex)", "value": "f2982a773826f9891ebb74ce06d2c39c7421c9e80e260cfb236fec44e2aca0cc3088f9854f466ae6a902d6b62121c29a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486085, "uuid": "8cd178ac-d495-42a3-a04f-be6cd03e838b", "value": "F8F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486085, "uuid": "51251e63-f6dc-45e3-84bc-b629322ecea6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486085, "uuid": "9a63363c-8467-46fd-9c47-c1f14939c01d", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486085, "uuid": "891ed3b5-c184-47be-ade5-0706234d1269", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486085, "uuid": "4d8efda2-a1a1-413b-b215-0e4d261077c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486085, "uuid": "203d357e-e04b-427a-9e20-7f3a2052003d", "value": "0ddb1761_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f7eb04-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457281, "uuid": "f6180f79-6b25-4412-8344-5def231193ec", "comment": "Malware payload (Dridex)", "value": "49448e7b0518c508dfdad73f67d1596f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457281, "uuid": "2acbc880-cdf2-4015-b731-2bb95f91a516", "comment": "Malware payload (Dridex)", "value": "4991efcf5348cf856fb43e854b1bc084695dec3116e6c2d86659bb58a95d14a0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457281, "uuid": "ddf25229-efc8-4c22-8d73-da79e52e5d09", "comment": "Malware payload (Dridex)", "value": "39a89bca94f40ee3cd9164db2249e4b6bf5eeb07", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457281, "uuid": "cd5bf248-fb13-40ef-a90f-cb790232e1ce", "comment": "Malware payload (Dridex)", "value": "7bbe0b9995a90e516099924d7512e162f46a111f3b0f1b34ad8a74a787bca641c30d97601f7cf42c20222b7830f01bde", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457281, "uuid": "2457d81e-a52b-4633-a08d-4d612c1c6152", "value": "E0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457281, "uuid": "f96e0998-6afd-4d33-a05b-8c3214d88e0c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457281, "uuid": "9cd750c9-c303-478d-a49b-ee74c5020215", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457281, "uuid": "29213eed-4d47-431e-9166-ff89d49d66e4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457281, "uuid": "f0da1cd4-5f8d-48f0-96c8-d8777d332421", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457281, "uuid": "d6ef95e0-f6e2-460b-a487-35637603232c", "value": "49448e7b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db5d715-b051-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620514934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620514934, "uuid": "1612e0f4-1966-4ee2-aeb5-394c9034f2c7", "comment": "Malware payload", "value": "229c90740d9084f70b2fd4fc131d6823", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620514934, "uuid": "0b402f25-dcea-419f-a88f-2839f7968c0c", "comment": "Malware payload", "value": "4a57655f9bc7772548a3088f65004e6c2058bd3d02bcd777ec6f6e7e12deaaf8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620514934, "uuid": "afddc42d-1506-4aa0-851d-20a4546ec61c", "comment": "Malware payload", "value": "a1d4861ed3beeecb75b9ecd4c7da641a0e351b9f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620514934, "uuid": "16507efd-1c6c-462e-8416-9f46d69514a2", "comment": "Malware payload", "value": "f92a852607f7faff88f828cf89204b03e03054eb5a853abaa8052dd62705c32cc8bbeae9b4f0212233c89cae92ffa859", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620514934, "uuid": "af86d5fe-b3df-4c0d-8dec-5e0504e4ef89", "value": "5DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620514934, "uuid": "ec1be00c-9fbd-45a8-9a2b-d89a9066b234", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620514934, "uuid": "93f2ecaa-962a-479b-8475-95c33b495a55", "value": "3072:Olpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Olo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620514934, "uuid": "d10d6f0a-8cd7-462b-93b6-90226a0fb170", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620514934, "uuid": "b0d716d3-d9f8-48c5-a6b2-2d952fc03e63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620514934, "uuid": "c561409e-77d1-4c89-967d-360b63d42c7d", "value": "229c9074_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e59f53-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475382, "uuid": "f0f36496-2f11-4ea5-99a7-59b12f6d9b99", "comment": "Malware payload (Mirai)", "value": "1f0771de8456f95588d6e72b80db2648", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475382, "uuid": "d3404505-e2bb-4eb7-b663-bf4b290c4aee", "comment": "Malware payload (Mirai)", "value": "4a9ebbb3af628b2ad0317cae120208199a61c43b5893e492d51c0801c0f3dc18", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475382, "uuid": "5c677e59-7299-4a0b-a0fb-d71aafa0904b", "comment": "Malware payload (Mirai)", "value": "c371477aac757a87162c7e55479ac0d0b03ec8ab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475382, "uuid": "3c4373c5-465f-47f5-b4a3-60c205e02a81", "comment": "Malware payload (Mirai)", "value": "3aaf2175edf3b99cf4a52a0f867d3fb076f478d7c2c9d3e62dcb5c64ebdd28621c6c87add801640ca9ec9dc8b0891f1d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475382, "uuid": "d00717e4-fa7b-4093-b7bb-de726adf617e", "value": "B5539319BF650FB7EC6BDC3705A9270128CD640A21A97B397D34D918F24B35B69F38A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475382, "uuid": "ab2ab9f4-b476-4f01-a0aa-4762e7a3be3c", "value": "768:kMGtA3Mmg4jG/qP30dJJd3Uzkew5zJeWeurePTyIAPgXimUE42h:kMGtA3Mz4jZAvXHD3raTyIgm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475382, "uuid": "99da3e9e-e24f-4517-8a39-b8e8d1bf572a", "value": 64192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475382, "uuid": "8ce6c8de-31ea-4313-9191-fce946247329", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475382, "uuid": "e4522b3d-77d9-4fcc-8514-60f2ba090732", "value": "Winbox.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b9aed7-afb5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620447973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447973, "uuid": "c9b7272b-719b-49f3-8589-9b8df3cba37a", "comment": "Malware payload (Mirai)", "value": "2c5aac6089ccc4fd293cfe9fb8a487a4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447973, "uuid": "4caad4dd-1803-4fb1-aa75-d2d5acf7d1fa", "comment": "Malware payload (Mirai)", "value": "4ab3159e052fb8a31499af2add2bc687770f488a8ba40a94365e4f98c70b9815", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447973, "uuid": "e300c9d5-e316-4408-bc15-e85a464e0c44", "comment": "Malware payload (Mirai)", "value": "046a9a03ad355aaeb73bdc41a78e94de8552a056", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447973, "uuid": "7abb258b-50b7-4e6e-9986-d67dbd216cbe", "comment": "Malware payload (Mirai)", "value": "8ee5cdfc6d9c3d73ee781c84a40fd6b623cf32dca2defb7f8af9319cd58b94072002ece447e26cc8a4e06b2d6ed59beb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447973, "uuid": "38a00e5c-846d-4e25-bc97-f8980fe242f4", "value": "14432925AD792E26C0D4B57A51F78714F2F2220E26B8C61E3CB21E4EFF04B4065577BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447973, "uuid": "76458cf6-adbf-464e-abcd-caf0dd6023e2", "value": "768:TXon00+q9wp3C+vactfa1sDHHYAzsv6WswWSHoXdss63B/9JO+zC3x:TXw00+SY3CaactfI6Hvzsv6vwcGJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620447973, "uuid": "fe46f346-4317-41c0-b5ae-e19923863d3e", "value": 60116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620447973, "uuid": "a5cf01af-ae25-4d1a-9f8c-35481ecca32b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447973, "uuid": "08ae3ce0-8e1d-417c-92b7-7d32ffdf1622", "value": "Josho.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2beeb77f-afa1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620439232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439232, "uuid": "806eca3a-7284-4823-bea5-d8cda6fc57ae", "comment": "Malware payload (Dridex)", "value": "f43400f39a54b8f393f6bf38c8958f76", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439232, "uuid": "d0ce4a66-53b4-407e-8115-7e5baa6360c5", "comment": "Malware payload (Dridex)", "value": "4ad430e221df532bc8bafb64fd92e73bc2b08c24f031c8f5fc0299c8c2c223d6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439232, "uuid": "a7654b82-aeb0-4a78-b082-9e7268b36caf", "comment": "Malware payload (Dridex)", "value": "d58c4dd28f328f9c5fcb9531f971c78bd78012ff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439232, "uuid": "de35f73f-77be-4abf-bb28-267d280975c5", "comment": "Malware payload (Dridex)", "value": "0f11324faeea0989554bed1532aced9f0b84a99de33a7f26ebe47c03001940a033e5b58f3d828715466d93894fb4e91b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439232, "uuid": "d41690da-b0ee-48ae-b313-ed5b304e2807", "value": "52F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439232, "uuid": "e9e0caf9-b68a-4cf5-ae72-f5ba23d02af8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439232, "uuid": "b6816cf5-f66c-4957-a76a-401a96ad1e14", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620439232, "uuid": "68a0338b-ac0c-4a6f-8e35-54bc4dc95878", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620439232, "uuid": "0ff771fe-9049-4e03-8427-b2815520edd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439232, "uuid": "516c951c-ef20-4f18-9d47-a11591ec9553", "value": "f43400f3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8194c5a6-b051-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620514967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620514967, "uuid": "f0b29bcf-9cb4-4495-bcf9-397abdddf049", "comment": "Malware payload", "value": "34ef4249b01e482473fdd7f6b0729a8b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620514967, "uuid": "d6862835-71da-48e9-997b-1154a6c5ba0e", "comment": "Malware payload", "value": "4c0125357b1fb8fec384037747491133ddf0f43f9666858f849cbc7d798ac9f2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620514967, "uuid": "29b333c9-3d5a-4623-94f9-c9d0bfb61458", "comment": "Malware payload", "value": "cee5b6fa34897d0a4fb6742fd0ad663e572fae59", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620514967, "uuid": "fafd31cb-f526-4dd5-8b97-328b69c65757", "comment": "Malware payload", "value": "e43d76dd2a768d2a0e920d0e82dff764db318b3d9fe6c14833b76f105776d119f87f4fa202c05d707107d108183b266a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620514967, "uuid": "68694691-8028-4469-89d3-2418e8f3117f", "value": "24F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620514967, "uuid": "56fcdfd8-b95c-47c5-9597-b92f0facd84a", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620514967, "uuid": "79f50bc2-e4e9-4653-a564-ea81b27d1202", "value": "3072:cWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:c42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620514967, "uuid": "74bcb008-3408-4260-b44b-71445ba02bd8", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620514967, "uuid": "2daf77aa-70ce-40fd-b8bf-cc04f58987d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620514967, "uuid": "9dee9bd3-75fb-4757-aa93-75b2b782dc5d", "value": "34ef4249_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3205b91-b005-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482516, "uuid": "6231858a-cdd9-4749-b4bf-7a3786f39858", "comment": "Malware payload (Dridex)", "value": "65932a482843e08ae3583af9cfff9c63", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482516, "uuid": "3a762916-a33f-4936-b07b-4f6c957a813a", "comment": "Malware payload (Dridex)", "value": "4c35b59efe796d1e6d93929275a609cae8c7b86652633ba1520fa907be39aff4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482516, "uuid": "479866bc-db24-43c3-9a68-d60ea340f1f3", "comment": "Malware payload (Dridex)", "value": "91df482a0567600d10cff2ef6669d01ece53877a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482516, "uuid": "2209ecc6-f8eb-465c-87ef-7924c1843d89", "comment": "Malware payload (Dridex)", "value": "c006c94011c3454662536f881b45408e642b2d95b008395cae12ece2611f91276c61f78ca005ce01501596cb1c870ebc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482516, "uuid": "57c8dac5-1061-431d-84eb-ec4f6b467ccd", "value": "F6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482516, "uuid": "abcdeb7c-87eb-45e9-bdb0-751535e8b5d1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482516, "uuid": "9a762865-96d2-4dfe-a512-a76c8fa69408", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482516, "uuid": "b1f8a929-c8be-4f36-aee2-4dcc6d8ded64", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482516, "uuid": "f9eb18c9-c4ea-4be5-bbc4-968d018b5046", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482516, "uuid": "bd372a15-7a31-4c0b-b43e-8f09ba769613", "value": "65932a48_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933b491a-b04b-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620512420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620512420, "uuid": "567e6410-a826-4f5e-8eb7-f55d101ba4bf", "comment": "Malware payload (njrat)", "value": "4e7621d6996000c2b37b1c52cefbbccb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620512420, "uuid": "4e081127-7890-4df5-aab5-274a2214b109", "comment": "Malware payload (njrat)", "value": "4df69875da6842ed184e6c2cc219a3497c279e575e8cd47ccc0982ce2e1f3413", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620512420, "uuid": "76fefc65-6e1d-4398-b9ea-88d06ab4e707", "comment": "Malware payload (njrat)", "value": "40a05a385fad2c96a887c1a646d2e0b03cb38c24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620512420, "uuid": "84535e01-d623-44b0-9add-f886e95e076c", "comment": "Malware payload (njrat)", "value": "377a04fcc663b77d04657b84d78905bb16f984d1df1ce036b2f329e11e5ce5560aeddcb0bb3c1253be73de53ce2f7faa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620512420, "uuid": "c779113c-4dde-40db-8ca0-5c8cde0f6855", "value": "8243F279C32AD67BC6AE27B4029F91ED73657D121385C7CB00E4263DE8F2B994A50B31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620512420, "uuid": "b36e4747-408f-4c45-9ed0-387c9b507df7", "value": "a50e815adb2cfe3e58d388c791946db8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620512420, "uuid": "c480ee03-ef79-456a-a8ce-e22d7a6c72e7", "value": "1536:2rPJVKjbcknWSOYvTfkWkFM79yQVkxcIg8:2LJMjbcHDdMwQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620512420, "uuid": "6ad61b0e-8a05-4560-92cf-a9e3b2a179f9", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620512420, "uuid": "ec7312b0-6734-48b9-aa0f-6692a2e8422b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620512420, "uuid": "d9cb2197-9b63-41fb-a77b-12381dd81895", "value": "4e7621d6996000c2b37b1c52cefbbccb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1d7d51-afb1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446430, "uuid": "30b5b153-9f27-4e41-ac28-ffef45ea50b3", "comment": "Malware payload (Dridex)", "value": "01800f1f430804c8702d544a740f5bcf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446430, "uuid": "91838c12-14fa-4574-a4b1-a6c1912ca996", "comment": "Malware payload (Dridex)", "value": "4e44806d59db3ccb6c9aa496de5f369ea73e9e1d45177ae57036fb5ad5a9ce50", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446430, "uuid": "71313f3e-94d6-4222-a8ff-d0597a7c765c", "comment": "Malware payload (Dridex)", "value": "4b374749a1a82affc2ecf29d4e03d1b5b55e086d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446430, "uuid": "0a8c7c9b-ff26-4d32-8916-c36c3cf5add7", "comment": "Malware payload (Dridex)", "value": "9af625a1bc96ad0defa017555e1cd5571718db2be7ac3c0adccbcdb547f369244cb502a2865d69b9e18cced53d9e1611", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446430, "uuid": "bd8194f5-ce33-4313-a366-b748ba77b6fa", "value": "87F3E00AED9FEA88E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446430, "uuid": "a79c30cb-ed41-46ef-8206-48bf0877e367", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446430, "uuid": "721d07b0-6b36-4245-8a23-167ef726a793", "value": "3072:miFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:deAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446430, "uuid": "8e2ee79f-65d9-4d94-9e85-c04a27da98ec", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446430, "uuid": "1723e982-7626-4bc3-b854-1880cf4e4d20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446430, "uuid": "c5a7960f-ee51-4e08-a5f4-bb44c7737beb", "value": "01800f1f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926cf5f2-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489655, "uuid": "f3dccfbf-7370-440e-a923-30f9e6f860fe", "comment": "Malware payload (Dridex)", "value": "11402b72b5424f3e0ff4a5588bfae293", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489655, "uuid": "f3041240-43ca-4917-adf6-826048f638ea", "comment": "Malware payload (Dridex)", "value": "4e6a7819967f406649d9946e79073088252cc7669dc811b7805206721e34c876", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489655, "uuid": "806f76d8-f081-4382-808f-5701f3710b33", "comment": "Malware payload (Dridex)", "value": "ea4f59b7e8d5e576cf0591b2d7bdd080d1cdff69", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489655, "uuid": "685f2ddf-0e94-46c7-9b7d-fcb977bbe5b5", "comment": "Malware payload (Dridex)", "value": "a89749beff9311525cb1109b27a263fa6c6816737fc4ca3395bfdfc466bcea15db5fcec560332952c6fbe8995ea2d6bb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489655, "uuid": "70a61b69-3dfa-499d-8f31-40c7030eee7b", "value": "92F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489655, "uuid": "cc6a00bd-26fd-4820-8385-691d39ffcee3", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489655, "uuid": "415ebc98-c28c-4183-9565-b8df817c04a9", "value": "3072:viFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:keAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489655, "uuid": "97ff46c6-320d-4db6-ae36-ba02eb2a4287", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489655, "uuid": "2e5505fa-eb1f-4d7d-b82a-d64fb0e73950", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489655, "uuid": "750b54d8-ca9d-44fb-ab81-8e205cc14d4d", "value": "11402b72_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e86f5fb-afba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620450081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450081, "uuid": "9f1166bc-e38c-4d50-84d1-f52b7316ae54", "comment": "Malware payload (Dridex)", "value": "4c4a20ce1f488931855df9c5b53f065b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450081, "uuid": "d9c863f0-0100-4999-9aa7-a89dc55572eb", "comment": "Malware payload (Dridex)", "value": "4fb2235379f6cd336e4d9214cb9f055715439e78cfbb988730a898941cf5a28c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450081, "uuid": "674665e8-387d-4270-bf20-51dcd6584d88", "comment": "Malware payload (Dridex)", "value": "c89fac723a7326415bad35c579810133608cc14d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450081, "uuid": "6fd38c30-73f8-4c28-9094-d82080401c50", "comment": "Malware payload (Dridex)", "value": "9dedda27a0be5633d7c6b154d29b6098d90121f045f9418e61f2cff24db5d87f9e64d562375cec22f49db9717257244c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450081, "uuid": "fbcdf98d-617a-4948-a052-c6b26332e68f", "value": "09F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450081, "uuid": "aea2600e-2e52-465b-853e-638614345f49", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450081, "uuid": "80411e6f-2fef-435f-af8e-605f1e92dc19", "value": "3072:9uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:90czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620450081, "uuid": "3df271d2-de87-472e-a2d3-e22ca896b53b", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620450081, "uuid": "56de67a1-9ef2-4297-9f92-05db6c9d8a9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450081, "uuid": "24a420a3-77e5-46fb-a345-34bb00f55fa2", "value": "4c4a20ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87499609-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620457424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457424, "uuid": "4caed22d-ce61-46bf-a4cd-7129027bb5f2", "comment": "Malware payload (Stop)", "value": "f2562d80dd1111b5c79bfa9806d8ac1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457424, "uuid": "67d63dfe-6058-4b44-b662-0135c6269052", "comment": "Malware payload (Stop)", "value": "4fc4936de4eb693ec57ae17e722c1c68e46afbc0c82f3c45d254c39571008f8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457424, "uuid": "0efda1bf-b480-4977-b4c5-f61809c64f82", "comment": "Malware payload (Stop)", "value": "e1d1db13a7ea71a2c9dfe66f81ebb741b7bf3cde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457424, "uuid": "c42757ec-c430-439f-a599-79309efe0472", "comment": "Malware payload (Stop)", "value": "bc2f83103a2d06c32aaee4cf826e1f7978ce73eafd2cd81d7de5bd14bb0e1a5424bb523e67b6f6ce2962e2346c7afdbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457424, "uuid": "56b24072-8310-42c6-85b4-06af5f89b6d3", "value": "8505F130EB90C034E5E716F88DA983AC6A2D3EA15B3550CB63D937ED16256E4BC31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457424, "uuid": "cbd76aeb-f7d2-44ca-b89d-81249d7e1643", "value": "39a74b7b85025eb79aaa0ef9cd5243a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457424, "uuid": "c0250ece-0687-4e7a-b434-bf4c495cf2ec", "value": "24576:AE/M6LDXBh43mCtB9raeqq7PKgS19821:4qDXD4W1eq4ygS/8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457424, "uuid": "18a4cbc9-1228-4b93-876f-e7af58e9e790", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457424, "uuid": "7b694a60-8d8b-49f9-b482-2fe865b4f025", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457424, "uuid": "7e5b2c1d-3894-4413-8aa4-5279232d1235", "value": "f2562d80dd1111b5c79bfa9806d8ac1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9538530e-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460884, "uuid": "5f5ec557-f043-47ae-896c-7b4a3246e5b7", "comment": "Malware payload (Dridex)", "value": "c57366510e159fd6620a3bb712e90a06", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460884, "uuid": "31c17515-44a0-48fa-8225-ccbcac0dd581", "comment": "Malware payload (Dridex)", "value": "4fe6002c10bc8d48bdfb97b113f433c663fea22e472ddc35d892dd8a2851c918", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460884, "uuid": "00a1b590-f2e1-4f8d-ae2c-0a735f3b5e19", "comment": "Malware payload (Dridex)", "value": "c6e17a3b587a06a04d31db6168911c19244aff05", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460884, "uuid": "952ca959-10cc-4083-ad26-6fcf36a56c92", "comment": "Malware payload (Dridex)", "value": "8c4659d1f05b1e7163c51649ed382d09a371633894eca4e29cc39e4006c2a2501a08c446146e54db8d23e04d0160fd03", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460884, "uuid": "54bec64f-903d-46aa-b93c-fdb2ef190a53", "value": "F4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460884, "uuid": "9c594226-0218-4ae6-a54d-d7e6be95beb4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460884, "uuid": "56b01420-2885-43b2-bf7b-800320c9ad5f", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460884, "uuid": "a375aa05-24ef-4f61-b59c-838f88b919c0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460884, "uuid": "2852521b-e90b-4787-8470-d635939e3141", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460884, "uuid": "fb8ac0f8-a3b8-46c9-82f8-abc26f596532", "value": "c5736651_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56289442-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620475381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "e4656a00-3b8a-4f2e-a1cc-ae4d327e771d", "comment": "Malware payload", "value": "3c61ecafecf7194d1cf3a3b9708950de", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "443afe11-cbda-4b20-9f80-502b47a118b3", "comment": "Malware payload", "value": "50d0bf232b2900153898b7af0c5eee7ffd5fb942066168114a0a5ae1be8859a2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "6f495f25-d9cf-4c76-8184-1f4dce86bc40", "comment": "Malware payload", "value": "97987bc2dff97d8f80a0722492a526a6f9b81cb8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "d027f34c-210b-4e13-9c19-35178a356120", "comment": "Malware payload", "value": "36b3ae6bf558fdb5e31be388034e22dace1b07c1af04211066c318be25a64345e99f5141a0296945fca65afd58d662ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "70cc7647-c2b5-4256-836d-cf7db6957f9f", "value": "16836D3285142F68E6502A7161F5CD3D87133EC047530E76E19A832C5AA7EEEF216FE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "7e7ce1c7-24d3-41d1-9c12-f397308b9101", "value": "1536:kCcKJWbkC+5eQZ18bSvTzMKrT1ZWy4tCkk/Uo3Ti:wKJ5C+d3Tray4to3Ti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475381, "uuid": "7c35119e-530a-4939-a7d6-a5b451f9139e", "value": 81240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475381, "uuid": "f83d89cd-4467-4da5-b627-02e204c6cf75", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "4b5287c1-58d2-4327-83f7-98dee1e26a2a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1815448d-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457238, "uuid": "1c0ad81a-b903-47a0-a47d-6087d0647a46", "comment": "Malware payload (Dridex)", "value": "49abea3b5e77bcc6ee3d43d1045eb284", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457238, "uuid": "46eeb7e8-4700-4402-9c9e-104ae32bf56a", "comment": "Malware payload (Dridex)", "value": "50e6f640710be8b12f7b472ae7c5ba7216fe74e43049c147a5b382fc4f1e9bb7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457238, "uuid": "96c5127d-6a74-4f6b-b2b8-332b329b9b38", "comment": "Malware payload (Dridex)", "value": "59b7b56b7f3ce900a805ee19ac5ff6f2f4944043", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457238, "uuid": "a472b03e-dc3c-47f2-a5a8-f53c8fcea63c", "comment": "Malware payload (Dridex)", "value": "6e030e395dbe06c1087cd008f2642045ff7e414f1caae493e69832c4f1c2ad2a00541e25f17f25b39673add8e3885a46", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457238, "uuid": "e4e504d7-4fa2-441b-8976-a942ac3909a1", "value": "EFF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457238, "uuid": "1bfc9bd3-09af-46a2-b81b-87d422b82a76", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457238, "uuid": "5aac006c-4e3f-449d-a512-866dbd6daea9", "value": "3072:4lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:4lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457238, "uuid": "1d5a094c-9942-4625-a172-a0073e98a1c8", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457238, "uuid": "003d968e-a01c-47a6-a311-58350e4d6513", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457238, "uuid": "1c0c2e09-0428-43b0-9acf-408420ee1a4c", "value": "49abea3b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cb529e-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486035, "uuid": "95564b4c-08fb-407c-b26f-e812f0539c03", "comment": "Malware payload (Dridex)", "value": "bbac2dcc1f2c79b7364c642bf1f042dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486035, "uuid": "305e03dd-e128-4c4a-8c73-b51e7390da71", "comment": "Malware payload (Dridex)", "value": "50f50917089787a92b0c708205f8c1387474330874fd7508967ef9412487b54a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486035, "uuid": "e519b1bf-8e2b-4d6b-8622-1a93da9a87ab", "comment": "Malware payload (Dridex)", "value": "a425f8c539a2f57123bc48414c526dd82fdf3652", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486035, "uuid": "fbfb3db3-a061-41ae-952d-fe894853cb0b", "comment": "Malware payload (Dridex)", "value": "24ca80e005765ba490382b51c22c54efcd1c2cf734a62b84d639d6e808421f154399d9d95203a13bf06c8a8a54211b6d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486035, "uuid": "2c45d5aa-d2f9-4fb7-9f39-78665895a455", "value": "1CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486035, "uuid": "852d5f98-6f90-4ae4-b9c4-c34bfecd0ae8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486035, "uuid": "00f4ad3e-8f9d-4ab5-99c4-2923b84de6f8", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486035, "uuid": "1cd54953-6391-4c00-b970-8e0999551018", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486035, "uuid": "00d3fbd7-7385-4147-99ca-0dd612b413df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486035, "uuid": "382ae801-a00d-4360-b995-cc81817fe23c", "value": "bbac2dcc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd15107-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475259, "uuid": "e5a9189b-5eee-480a-b034-7ce26d7c8d81", "comment": "Malware payload (Dridex)", "value": "4bd2442a82182936b3a77c034e860603", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475259, "uuid": "40a2ec36-7750-4ff2-942c-7a7111ea08a1", "comment": "Malware payload (Dridex)", "value": "5122390b36bb4a984bf0b19df8f09a5f05eaccda97a65aff7cfd41de14c17561", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475259, "uuid": "1f91c3f1-6a8d-4110-bd79-8dc847fe1f4c", "comment": "Malware payload (Dridex)", "value": "cd242d6e0899bcc3da0a67d4dc2a0c2d770e46fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475259, "uuid": "62b1c780-06a5-442f-9bee-03e5944c7088", "comment": "Malware payload (Dridex)", "value": "f580df3bd6b5f73d69f200a08aef4a98c79201e1ee2f01eb3420d56328254486ddf3e7adb389c723202524f3fc7ab9aa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475259, "uuid": "08670eec-11ba-463a-a25e-36c9727ed933", "value": "ADF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475259, "uuid": "1ee55e42-be46-4b1a-a791-5ebc725c20fa", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475259, "uuid": "80197adf-abf5-4030-bbe2-eac7944a77e4", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475259, "uuid": "a11ab56d-4063-47c4-b09a-135b2ffbe131", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475259, "uuid": "bb2ec19e-7c30-4ed3-b8f4-7f6045239868", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475259, "uuid": "f4e25921-973e-49b1-b2b3-8048f030f3e7", "value": "4bd2442a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55565ce9-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "e8e711a5-7803-4b11-901b-051837d168dd", "comment": "Malware payload (Mirai)", "value": "0652d6dea077e0c688107cc91d50d490", "object_relation": "md5", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "7fa54c15-bbf7-4232-b939-06de5af550d0", "comment": "Malware payload (Mirai)", "value": "51d497b6e9673e7f0c5bf3794d718cd16486efc7107544557553c847fc65c137", "object_relation": "sha256", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "28be978c-afba-4b1a-838e-9aa162cccd01", "comment": "Malware payload (Mirai)", "value": "fa76b158530e88f5269641d282fc91803835feaf", "object_relation": "sha1", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "a34f3666-5d4e-4e23-abef-1dea1b0e823a", "comment": "Malware payload (Mirai)", "value": "00a7597b201ab7f0feea67e9c179c18e3d489d5cbc8bebc10aa05440acf432c566b1ba326a70c02aa7fbc943e8cf0763", "object_relation": "sha3-384", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475379, "uuid": "7877391e-806b-402e-a1c7-9acde198dc88", "value": "79530A817C916A39C7D0577BEAAF108E3354ABD9D0DB7347CC044B917ACA90B0D6BB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475379, "uuid": "fc6edd44-fbe0-43cd-8b25-89a68c2dcf20", "value": "1536:dOxGfyRWiPLacGXWzM9l6yTzpl84ETjpk19y20Yvck6YceZWGzD0MH:dOxkyRWiPkjX0QckVcwLZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475379, "uuid": "8664d778-b24b-4bd4-b6e9-e3971ff0ce06", "value": 62680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475379, "uuid": "d19adad1-bbbe-4f89-ae2e-2a898b015b8c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475379, "uuid": "e020ec6d-5aa0-4f78-8692-ba21695f55fd", "value": "loligang.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ddd1742-afdc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464522, "uuid": "dfeac980-e3c6-4195-9db8-ba40ea41e17a", "comment": "Malware payload (Dridex)", "value": "4ec06e5007adeaf547c4f3b7e8fc18b9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464522, "uuid": "eae7aaca-739e-40ec-b1c6-bd828528808d", "comment": "Malware payload (Dridex)", "value": "5205f6a5995095356387d944e2ad3daa3a094e630ecd3be1734020b40aebf5e2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464522, "uuid": "123ec8d3-1287-4960-bc28-77cd47d40ca0", "comment": "Malware payload (Dridex)", "value": "92110742ffb660bb50957cd777afdffa0a4ff8b1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464522, "uuid": "a13052f8-c9c6-4bfd-abf8-d15c3031e6e1", "comment": "Malware payload (Dridex)", "value": "f2c24672a08379931d2142cbc227ec6365bfb5d5c60cc40a09de4ff96c58c45ce05157466c13a57f959472a7374e28bb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464522, "uuid": "038caa59-4fe5-4947-87d2-e92fa1103698", "value": "7FF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464522, "uuid": "76521ce1-8ba6-4e7f-835e-2c8f78db5fa8", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464522, "uuid": "ed322186-fffc-41d0-a188-043b9aaf9744", "value": "3072:Le45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:K4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464522, "uuid": "47adfba5-9cf5-47f8-974c-40202b8a9cc0", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464522, "uuid": "c273cf8a-ec87-4dd0-acca-dd027eced0d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464522, "uuid": "b81512ef-06a7-4a63-b22d-d41519885272", "value": "4ec06e50_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fde7fa6-afb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446487, "uuid": "0f1e5759-ff65-456d-9662-5610a5df4396", "comment": "Malware payload (Dridex)", "value": "05435425be07897f762ef0ceb04edba8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446487, "uuid": "f1263363-859a-46ee-9b25-0e5c1ddfdd3a", "comment": "Malware payload (Dridex)", "value": "5247d3972d4958652103e79b9712b9b77fda938c8330874bb6d12e1f7c9f7464", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446487, "uuid": "92ac84fb-93f3-4edc-8689-d74aa68be871", "comment": "Malware payload (Dridex)", "value": "73a14bb831362fa571a52e8c0f8edd201fa4ecfd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446487, "uuid": "afc2e59e-9357-4c46-9e74-43b9fe1c4e16", "comment": "Malware payload (Dridex)", "value": "83de08dd035d878ec1ef3eb16922ef8acc41a421ebfd74246a858065483f1b75855470c9b258de63d3da3e23e1410fb9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446487, "uuid": "2f826321-865d-4085-bedb-be3a69a8d5a4", "value": "6AF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446487, "uuid": "75b4e528-24dc-49cd-a79d-f5f2bfa2b2ce", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446487, "uuid": "6231c150-fd99-453c-a45e-72246ff5eecc", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446487, "uuid": "79836367-0c6d-417f-bc77-389c1c349ddf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446487, "uuid": "41e6a336-ee2d-4c6e-aeeb-162e7a3bb6a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446487, "uuid": "91407925-769a-4b65-983f-8d92d37974d9", "value": "05435425_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb514d2-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486054, "uuid": "06462323-7c69-4fbc-9b56-45e99fa2a2c3", "comment": "Malware payload (Dridex)", "value": "e9b3d83aa7166ab196ef500f9e4b9b50", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486054, "uuid": "8f172588-25da-4722-8fb3-f7b24663844c", "comment": "Malware payload (Dridex)", "value": "52603394592ad7070ade50ab63aa5396e5251dcf3bf83996726cc9aaa3dbee2e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486054, "uuid": "69d2b2bc-6094-449c-8b72-64620aba40f4", "comment": "Malware payload (Dridex)", "value": "0b0e0b9578003944126ab722e175ff3d8bc037a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486054, "uuid": "32ae2211-a1d2-4bfb-8da8-9b68f827fa44", "comment": "Malware payload (Dridex)", "value": "dac127d1ac26ad5a05d9f7309833d65593422b60133e098264dd7e5bd09163712f9ceebe48d4082ff66f9cc821441450", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486054, "uuid": "fa8b1676-9ec6-4167-84aa-78dffe536f3f", "value": "0EF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486054, "uuid": "c203a8a2-5a78-4b06-aba2-a2810d911d28", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486054, "uuid": "d7903495-ed7e-47a5-9b08-bfa65525818a", "value": "3072:vA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:v3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486054, "uuid": "79ffaa61-d291-4bfa-a508-42bbf63663f6", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486054, "uuid": "c23d0f40-b2c7-4764-89e5-26bfb416e734", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486054, "uuid": "6c088514-23ec-41e9-9271-8b2d128e680a", "value": "e9b3d83a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08847476-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475250, "uuid": "fa6a87e5-f5ed-47bf-85bc-eb224cadc573", "comment": "Malware payload (Dridex)", "value": "9ef1ef38d55451fd4a0704381d7cae9e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475250, "uuid": "57b4c81a-9142-45b3-b4c8-5949198efadd", "comment": "Malware payload (Dridex)", "value": "5269897003abb45182264603fe019d0b1f07097fbdc2ce12879873df567191d5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475250, "uuid": "b285dda5-4e28-4035-882e-e1df52bc2702", "comment": "Malware payload (Dridex)", "value": "7c550255158dfdc653c1e58349a888aad648d9c9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475250, "uuid": "ea2d6ead-595c-49ab-b92f-3ca01d0fd646", "comment": "Malware payload (Dridex)", "value": "52a2ee636a3ccd8d6d436dc8d50279848811a831d8071c8fdd916e5465bffdf99a97a8ea354e295d77827a97485a0328", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475250, "uuid": "55c7415d-293d-4032-9f0f-8440c33e0be1", "value": "01F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475250, "uuid": "ebff26c1-7abf-45d7-892a-e278346697dc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475250, "uuid": "bee7b829-b3de-49d3-894b-b15306014fb0", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475250, "uuid": "13b9990d-710a-4413-8e97-270de5855e76", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475250, "uuid": "ae7c3dc2-ed24-4c8b-84a3-963bb76faf03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475250, "uuid": "64a5b573-b912-42b5-a441-a53858feb757", "value": "9ef1ef38_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4a4560-afba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620450074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450074, "uuid": "450528eb-188f-4d7f-a9f9-93909e1a1da2", "comment": "Malware payload (Dridex)", "value": "0a95b971b2999a0d6c2800d5548af521", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450074, "uuid": "1950fdff-ce3c-4e18-bc85-3dafd6a326c2", "comment": "Malware payload (Dridex)", "value": "52c20ff4311f314c514463d20fbaf304deab46bf732b4f9102b4244641c7b4d3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450074, "uuid": "b0609f0e-2fef-4b70-a813-23a77356d96d", "comment": "Malware payload (Dridex)", "value": "9b89cbdb1ecc262a45039d064664979bda03f6e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450074, "uuid": "91861088-840b-4d09-bc2a-1409ff5dad0c", "comment": "Malware payload (Dridex)", "value": "a3d9ec035b995c681a3ca09625a5a03352dc1196014adf3c6908c699ff077439320c899615e050d32882f72159c77837", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450074, "uuid": "ea20f256-2ca9-4f9f-a53d-9aa4ddfefce3", "value": "67F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450074, "uuid": "330b7935-276b-4439-9aa9-e49b3dab978b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450074, "uuid": "a5606317-150b-404f-a50e-4d39e605c26b", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620450074, "uuid": "99450969-de05-4031-bb29-d83414b336b5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620450074, "uuid": "d81a88e0-8e8a-4893-9fb9-4c9b827fad21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450074, "uuid": "e575fc3f-b61e-485d-b649-1acc452686de", "value": "0a95b971_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c89ae5-afba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620450033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450033, "uuid": "c892306f-b636-490d-b51f-7b21b0d358bf", "comment": "Malware payload (Dridex)", "value": "e94f26c9854c560e8fe2a782de014c18", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450033, "uuid": "95b9f29b-4b9d-4a88-bef4-0c3429e7ad76", "comment": "Malware payload (Dridex)", "value": "52c3a5c807488954842887ac60004c1eab7e43fdc94208e1f2a934afdbc3bf16", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450033, "uuid": "29110a35-c152-4a1e-8c2a-a2285c1951f4", "comment": "Malware payload (Dridex)", "value": "18f01f139c446833986e7d5ef6b49ab43d3723cc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450033, "uuid": "ab7ac382-ea08-4f41-9ace-1f5ee6409ce3", "comment": "Malware payload (Dridex)", "value": "ea6597709b7bac905a83aedd490450598bf31fcb8a1ef615b87e547dba60123c0fcd90a1220593c6265d51678f81d323", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450033, "uuid": "74539d50-ec05-4368-a3c5-6c4c79cbc73f", "value": "DEF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450033, "uuid": "fcf08186-dec5-40b2-b33e-9e171401fb22", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450033, "uuid": "0c826ec5-4b79-4e98-beb7-61f58071373f", "value": "3072:1iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:eeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620450033, "uuid": "752fa5ec-328f-45f4-8be4-46d36f53c1f7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620450033, "uuid": "b2a88e12-f8e2-47ca-b3ef-658fd86ff727", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450033, "uuid": "b227d58a-5eaa-4c31-a7fd-f09faedbc6e5", "value": "e94f26c9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de691a8b-afca-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620457141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457141, "uuid": "ef1b6388-99f1-4af1-ac30-c1d41d1ed6f2", "comment": "Malware payload", "value": "666e4c89ae258b45e693829fda671de4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457141, "uuid": "0b4f7b7d-7060-47bb-999e-a6c4117e3776", "comment": "Malware payload", "value": "54481224f0255e9473d89926430fc440c5948ac5842593380ceeb2db169a2ad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457141, "uuid": "add62d0f-72d7-4eaa-ab70-0fcbacddb9f6", "comment": "Malware payload", "value": "e7edc65df802875b2866cd99129ff3b4ca7aefa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457141, "uuid": "ec984dc1-c5c6-4f9c-9105-16486043a915", "comment": "Malware payload", "value": "0b842920563a132bddf3bcf20b7dbdcae553a6da4d396409cdc8f7732c0c145816bea8d60bca8049d201a680cd73365a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457141, "uuid": "30fbd695-98c6-49a6-b654-a3e75288d769", "value": "B39533F5A67E4B738424C37C32998E6D60E9B335A2DFC1A6E7AC2A93414C3142D06D4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457141, "uuid": "a01252d5-6bf9-41d4-91e9-81ea217ea280", "value": "49152:zm2AGtwmLkzj7Bvy57xPVVeBVrAz3M+ok:JAGmmLkX7BalxPV0DMz8Bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457141, "uuid": "ea4c7620-c479-4627-8a74-1d2c15915b4c", "value": 2026947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457141, "uuid": "0653495f-efdc-4d07-a2cb-764821889b58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457141, "uuid": "57d0414d-0811-4da1-8512-7363c28e82cc", "value": "666e4c89ae258b45e693829fda671de4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e056426e-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435669, "uuid": "a3f138dd-cdb7-4326-b845-41b870a64fd9", "comment": "Malware payload (Dridex)", "value": "ba11000548b0b18a7755b051f309af87", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435669, "uuid": "1f8d1346-5c1d-4216-a1c7-098f86ffbc68", "comment": "Malware payload (Dridex)", "value": "563cad372489edcfe871d734827995ab939904ba25d39401ab8064e9fdc38675", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435669, "uuid": "a8f3121f-1a5e-4fec-962e-1ef7d23c5c35", "comment": "Malware payload (Dridex)", "value": "d0c7f3f1f0afc5bb3221c3f8fd9d8230c35da04e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435669, "uuid": "4d1c9d79-fdc6-41d4-8153-4f8eeac449bb", "comment": "Malware payload (Dridex)", "value": "72da1e23b9c2831761433e123a07849f4e7d5cdb52a4dbecd4d7971b5fa737aedd7f8170dfe47e39d2426f34efd1053e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435669, "uuid": "1a1e4eff-412f-4ea9-ac48-8327aa2eea21", "value": "2CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435669, "uuid": "9cf23a12-5e86-4c26-9fdb-7c243cddca63", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435669, "uuid": "65e3de06-3b5f-499d-93ba-2fbf10fdb0ba", "value": "3072:RA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:R3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435669, "uuid": "cff43f7a-ab09-433e-8d12-32e3951ec9d1", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435669, "uuid": "cfcaab95-a2c8-4599-8027-3311c73fecfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435669, "uuid": "7433c130-66f2-4644-a798-505759fa22b0", "value": "ba110005_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c26792-affe-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620479195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479195, "uuid": "a2ee3960-f087-4d8f-81e5-1e61b7152bb6", "comment": "Malware payload (ArkeiStealer)", "value": "f3f924e259a97c881baa607d181dd63c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479195, "uuid": "3d289ff7-8fc2-4a50-a1e2-f4d8287e54f0", "comment": "Malware payload (ArkeiStealer)", "value": "56afcf5ad421c5d9640cf2269c46cbbdc72f1161a08e32aa9eae41071d785edd", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479195, "uuid": "44ce9bc2-feb3-4dfa-8a84-8ed9c61582a4", "comment": "Malware payload (ArkeiStealer)", "value": "55a5e39e1655d4fef62de9447d23062c169f31d8", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479195, "uuid": "04372098-6764-4b49-9d72-025e0963ab00", "comment": "Malware payload (ArkeiStealer)", "value": "4e77f9dbc336a4d888a206f1a10f49f27b3ae5cd93d44ba45bda33086b6cb2cdf4088d60091d388d329fd39ed06e97b2", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479195, "uuid": "457a8064-cd11-429c-a95a-4a06b89e1c4a", "value": "78F4F1127582D132DC761D360025C7749EBBB8B25B215ECBAA8D2B79CF247E1BB2134D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479195, "uuid": "7be547ac-8c4d-4593-83b5-7a006a384aa6", "value": "d74462f62d585085448b55e915d2732c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479195, "uuid": "ed70409e-d12f-4d8c-9c16-9e564a1a2fcb", "value": "12288:sSmamm88FHzHNzw6q1hjw5fYVZ0mwXOCUy1l/TNmRmqZzVJLmUx:sS9mWFHzFrqP8YV/wUol/SmqZGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620479195, "uuid": "bcb07a1e-f2db-4612-994b-b8eaf1b11308", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620479195, "uuid": "a8577c0f-eb81-4c06-9316-6c0b7172308b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479195, "uuid": "c1c317d5-5912-4fea-a2cf-dd45bf6ce8ac", "value": "geris.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e328e6ee-afca-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620457149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457149, "uuid": "a0696043-27be-425e-b508-43d7be1adb6d", "comment": "Malware payload (ArkeiStealer)", "value": "284edb08992a61a0e4e4574e2647d471", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457149, "uuid": "67ad3803-cf6c-463d-aaa3-3a03dd53b069", "comment": "Malware payload (ArkeiStealer)", "value": "56ca0519f28716014e5afa631397268e830e186d381a0f49dc448c763f3b51b0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457149, "uuid": "158215ac-9b2c-4da2-b6b5-799bb4313c32", "comment": "Malware payload (ArkeiStealer)", "value": "370d7a2224c4a4a4e87c7f5494d5989e3bc04590", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457149, "uuid": "441158ab-534f-4004-abe8-ae5e785c3b3a", "comment": "Malware payload (ArkeiStealer)", "value": "d08f679c91714549ace210bff83a8cac64f76f007eb588498044018628d078e46371a851010f93101ace9d97c107d00c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457149, "uuid": "b2cd24e8-2bbf-421f-ac35-de41ce70436f", "value": "0CE4E020AA91C038F5F316F849FAB3BDB63D7AA15B3450CB13C53AED56256E4EC31246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457149, "uuid": "a34e1098-83cf-4f90-b34d-5d2c2102b7d4", "value": "39a74b7b85025eb79aaa0ef9cd5243a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457149, "uuid": "6ff757e7-557a-4be3-9501-0d95bb004e0b", "value": "12288:h3JIpRQ/V5ZmBeej+tHqVBKsWp7HUPvwyPX4tSgegMQ:gQ/VejiqnKh70PvsDMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457149, "uuid": "048fbd0e-8115-402d-a7ec-0c4bf5a85d96", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457149, "uuid": "20ea528f-657f-4752-bdb4-36af252279c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457149, "uuid": "046a2c12-bda7-4e3b-bfca-8fadeacc073e", "value": "284edb08992a61a0e4e4574e2647d471.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753b8f12-b032-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620501632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620501632, "uuid": "43578d41-afdc-42ec-8bc0-60d312ba5b0a", "comment": "Malware payload (RedLineStealer)", "value": "a79fa131802a1b663d01387ab0c566e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620501632, "uuid": "e9efe2f9-90fe-4649-95bc-4c8a64cb8770", "comment": "Malware payload (RedLineStealer)", "value": "56ebca4074c46b7f7641740c0ee8241dde4dc956fc149d5dc4162fafc2d5a64d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620501632, "uuid": "b5621afd-9d60-4136-a77c-f605ada440bf", "comment": "Malware payload (RedLineStealer)", "value": "30318d1baad63ad0c3c3c5c7887fc56e4f2750d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620501632, "uuid": "7b2f32e4-ff77-4688-892d-7e819ca43c91", "comment": "Malware payload (RedLineStealer)", "value": "dcded8ff34e05f3c1b7a21b210df4831fe4ff047250d419d573a79c6528248e6404058edb4414acaeaf0a780a7767aae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620501632, "uuid": "e045fab7-e44d-4702-b0a6-39930d8d8054", "value": "25155BBC761498E0C3475D3297CF8C1A42652E70A93BDA1A5BA137BA2933F533D358C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620501632, "uuid": "0f0dae85-b357-4c3e-8bad-b09524c6a894", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620501632, "uuid": "37fbce66-fc36-468b-b94b-1f6a6bbb4e1e", "value": "12288:bTfW8oLLoS60/K7yh0mUL7u8P7jJL/SZPLBHB9olETdgqk9R3QHSrXlhP:bTfW8oLAmO7uq1SZPLBHklErkUHcXlhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620501632, "uuid": "c73c1fb3-b49a-4706-a444-8852c654284e", "value": 884272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620501632, "uuid": "d0d22bfc-b55f-40c8-a3b7-cd5200d02e96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620501632, "uuid": "60c5364c-1b55-4efc-b837-622c7df0231e", "value": "a79fa131802a1b663d01387ab0c566e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470c0f18-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620460752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460752, "uuid": "f7b52a8a-d7ef-41fa-aad8-4cdb7d8f1036", "comment": "Malware payload (AgentTesla)", "value": "df437813f804f3c1506b87b3373c2de6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460752, "uuid": "0c64b486-1555-4777-aef7-09b695190c43", "comment": "Malware payload (AgentTesla)", "value": "572129bfd641baef5fe4a789dbc4cb9bb0d6fa4403db72c87b12a4aaee0e5e0c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460752, "uuid": "17553dcc-1572-48ff-a707-8331ea9bf024", "comment": "Malware payload (AgentTesla)", "value": "947a054111ac56a4bdefcf89994a88d032b70891", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460752, "uuid": "768b3c14-4982-4302-aedb-ca50c34d4882", "comment": "Malware payload (AgentTesla)", "value": "5e3387b5a5b826f562afe3f5bc71fcc04b2187a0113d74b25e97bbffa482f5ae7ad991ab1a5927c901419f857c52599f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460752, "uuid": "0be86a41-4356-4c99-b480-f35a52712646", "value": "A6C4025873D8EF58D67E5B7A09B0660013F8B6169F57D30D6E8890ED3CA7B84C229363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460752, "uuid": "bc5c22ca-f7ec-418d-88b1-d7a153b7f98e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460752, "uuid": "f641d012-97ae-47c0-9efe-1a01f3c3ef0b", "value": "12288:2B9XMwvfG5JClSO59fL1vwhHUGVw8ChDX2r/rNBkCYCOw:IXvyvWGVSorN2x4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460752, "uuid": "04aea1ba-efc2-412a-ae83-39b488b0143d", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460752, "uuid": "e4b96af7-cdb0-452a-8f18-91c10bfeee7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460752, "uuid": "5a8fb9f1-1b2a-4e4d-abaf-82f59da6f44f", "value": "Polti Delivery Note 0110010597.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04238b3-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489678, "uuid": "38150c65-a56e-440f-9412-085f237626de", "comment": "Malware payload (Dridex)", "value": "c538faded006a6a8e10e84cdaf5146f9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489678, "uuid": "7678df66-278c-4431-b31c-2df217118935", "comment": "Malware payload (Dridex)", "value": "57a9989dec05eb14cf3bd6be3642e1eddff3978496b7ce72bdb6fe9540221170", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489678, "uuid": "6f49ead2-e760-471c-8e0d-811cf65a9a30", "comment": "Malware payload (Dridex)", "value": "6c6b507d461d983b597908de3ac2bb05ea69ac64", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489678, "uuid": "44affe5c-5d19-4254-b1c0-9a8b69599d04", "comment": "Malware payload (Dridex)", "value": "003d9e8097be07c68095dbab61e5b362d4124b85d6e81593e3d8e15a300fd0c965f91c5905d04bd434c26a26b4ab7f57", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489678, "uuid": "87502a17-c10f-42e3-bfb3-68dea79a7274", "value": "3EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489678, "uuid": "636c7c5a-19db-4ad7-afa6-59c691317e3e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489678, "uuid": "d1ae17f3-8b83-44cf-9cce-2371c7972566", "value": "3072:Ylpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ylo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489678, "uuid": "698cc648-53a6-480e-92e0-370a93270550", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489678, "uuid": "388707be-39a6-4435-a8ac-086364fc3c38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489678, "uuid": "5d309e54-7251-47dd-988a-21df37c54b31", "value": "c538fade_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c705c0-afd7-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620462688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462688, "uuid": "c40cc58e-d4f5-43de-93fb-8b8552cdfe12", "comment": "Malware payload (ArkeiStealer)", "value": "e2969c6b371439020ebcabcbe5d0124e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462688, "uuid": "81e726e1-dd06-4b0a-b791-880ac5701c5f", "comment": "Malware payload (ArkeiStealer)", "value": "57dff4d4cb63afb347c9e87ae2009047e4f4afe8059418cace04bd4d9c693ad6", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462688, "uuid": "3e9ac80d-b56a-4ab0-b8a3-97f329ab1b09", "comment": "Malware payload (ArkeiStealer)", "value": "0672999707beb9b98478d1434169118d06a97701", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462688, "uuid": "71b1b674-efdf-4722-9101-495aea118b96", "comment": "Malware payload (ArkeiStealer)", "value": "2e800ffa8d0fb0d407e4b012b3332007febde9bfeca2fd258698e27618c18ae092c238285c5608a1a457a24aa7a3decc", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462688, "uuid": "503a6b62-a457-4fc5-ab67-3514bee8a3e9", "value": "EDE4E1227580C032DC361DB64415C7799EABB8329B159ECFAA8D27B9DF247E17B2430D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462688, "uuid": "ae809f98-9480-4f18-8b42-329c5d64a7d7", "value": "0eb744574666f2607e9c304d58194156", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462688, "uuid": "c2c448f5-5fb2-4881-b455-b3a47311a458", "value": "12288:llfzxSJmsJBYBVV7h/nV9tD/D6lHptVB1WJBAVJLmUx:llfzxSJ5YTV7h/nZD/DMdB1WJBrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620462688, "uuid": "e34e7bf3-061b-4541-a76f-3b272b1d544c", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620462688, "uuid": "0cfe1245-2f63-4a92-a1cd-ce5c942882df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462688, "uuid": "6944e257-5791-488b-a8ed-899bcdebb1bb", "value": "e2969c6b371439020ebcabcbe5d0124e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8b9a0b-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442884, "uuid": "edb7885b-a662-4f47-9aad-f373774cc6d3", "comment": "Malware payload (Dridex)", "value": "61d6987e67e03ec9726000d5a6ff7a75", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442884, "uuid": "be327acb-522a-4b51-8123-83d201fa1a90", "comment": "Malware payload (Dridex)", "value": "57f4f1ea64370cfc59bb7e616a89c1901426915ab9c7cb1b6715c9cbedae2369", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442884, "uuid": "84d6ded5-84cd-495d-a98c-0f0c21a578b5", "comment": "Malware payload (Dridex)", "value": "1f8ee88513dc4009ad6aa6218051dfc8955e92b1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442884, "uuid": "3006c18d-60ca-495a-be9b-3a886ccaad4a", "comment": "Malware payload (Dridex)", "value": "5d19ef66921e4a7e83dd8a1dc7bac98db1797001a8c800cf706ecb0d85780f4e9999017c11daa924ee90b681cc45b085", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442884, "uuid": "4e75fdcf-96f3-44b9-b132-6f6ac83ddc1a", "value": "EAF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442884, "uuid": "6b4f6317-605d-4ea9-bb16-3700354c810e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442884, "uuid": "e93202c8-2937-4d77-9690-35b699cc316c", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442884, "uuid": "70918eff-37bc-4bdc-9338-7cb3b92a9dd1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442884, "uuid": "31c443a6-6702-41f6-a2b6-23a24badce02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442884, "uuid": "5e352bcb-a500-4b56-b060-093a7ffa8264", "value": "61d6987e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9bb836-b030-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620500755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620500755, "uuid": "00f4db65-4cc9-45d9-94ad-426e92fb7a9c", "comment": "Malware payload", "value": "3c361232a2c5ac35c3514c22286de985", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620500755, "uuid": "fe4dee0a-2b35-4b66-b581-19050b62037e", "comment": "Malware payload", "value": "5882dabaeb983ed76e41c8c261d40258aa2b6c267505a6b165246db20e23e549", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620500755, "uuid": "ddeda1b1-be4c-40a5-8131-617194a836e1", "comment": "Malware payload", "value": "2339a5f8edb76648c68e23b045447828644c68b6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620500755, "uuid": "34e2b02a-3b35-46df-bb81-2dfae4bfa2b9", "comment": "Malware payload", "value": "8994076447070ed8703ab0713a84ee4c2cb354a1f1504b4b500f9111872667851013f05285cd5857ee0a52768d94179f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620500755, "uuid": "e080454f-16ef-43a2-b59a-9eef5c6c04c4", "value": "06F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620500755, "uuid": "be28fc64-6ad4-465c-be39-098383f4afcb", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620500755, "uuid": "6be9873b-f33a-49e9-8f5f-4f4cce519d10", "value": "3072:rWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:r42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620500755, "uuid": "bb27df2c-384a-4734-ac2d-51ef3bc1e222", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620500755, "uuid": "4f6bb6c1-077c-4e0b-8097-82a5a40a05f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620500755, "uuid": "dafc77ff-ffd4-4b7c-94dd-bb1c7fc8999f", "value": "3c361232_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d6025c-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489641, "uuid": "2cfb86d1-1fc4-4d14-a4e8-f4f265b7eece", "comment": "Malware payload (Dridex)", "value": "f9fb981f08dc264b33447471187f3799", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489641, "uuid": "db5656fe-1cc5-474b-a7e8-54300a7737f5", "comment": "Malware payload (Dridex)", "value": "58bfe72247973feb6ae79462590fdb9d4ede3a68d612b1a4bf4ec7af360b78a2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489641, "uuid": "e98c3567-1e8b-40ec-aa8f-73630e2d4867", "comment": "Malware payload (Dridex)", "value": "20050fd5486c9f92a981391e550de78ab11e9755", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489641, "uuid": "143ae61d-0e37-4b77-9f47-9b9c7a7cc052", "comment": "Malware payload (Dridex)", "value": "92c55e60ecd00bad6f5531ba9f6ba4fe86db4516ae072a45b51bc2262e233485baf14ba299adbc59c6bb5aacd71e01cb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489641, "uuid": "3ea5c1dd-b5bd-4e9f-ada1-53590fc7f9d6", "value": "E9F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489641, "uuid": "bb2173ab-848f-4800-8ec9-04547df71c60", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489641, "uuid": "bcd16352-d0d0-4b5d-afcf-c16be3a415f9", "value": "3072:4A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:43J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489641, "uuid": "6cab650a-5592-4dc4-ac6d-b1c79265235f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489641, "uuid": "b0e538e9-3df1-4484-b370-4ff62e391862", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489641, "uuid": "f58af2be-e860-4423-a618-9ae595fa43da", "value": "f9fb981f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c23f26-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478947, "uuid": "442383ca-c42f-4314-918e-21d89fb89425", "comment": "Malware payload (Dridex)", "value": "e65cff3a740f56933ab98d54582b2fb2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478947, "uuid": "99366141-2ed7-4124-8982-82f444d44f33", "comment": "Malware payload (Dridex)", "value": "5910688e5ea07d76a130846db93ce522b52d62062fd7d00e5569f8618016cb9b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478947, "uuid": "c52683c4-f528-4e6e-be4d-799d5024916a", "comment": "Malware payload (Dridex)", "value": "1a665c1d44ce5cf5d84992e791e989cdf283592a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478947, "uuid": "ec608f55-a64d-4a48-a9fd-cd4ec8797af0", "comment": "Malware payload (Dridex)", "value": "045bfd4b200848e050bf758ccb1cb0d55a90fd6d92c43b9a019277697cc364106f157525463b7260f626e81a29425d80", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478947, "uuid": "200f43f0-f5be-4145-a06f-40b4e553d7b1", "value": "E5F3C088CBB3E4E6EFB2D37976F85E1B460674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478947, "uuid": "bffecc24-2eae-4743-93bc-13ff44ff0ed5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478947, "uuid": "6028efd0-b710-4e8d-8619-763f710513ee", "value": "3072:RIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ac7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478947, "uuid": "a7cd590b-1b9c-4c5b-ad39-0ea148b2d18c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478947, "uuid": "3f2849a3-5d6a-4371-92e3-896c7d50408e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478947, "uuid": "dc272e82-fdfe-4a5c-8de6-56fa00aa1652", "value": "e65cff3a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b06dedc-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486046, "uuid": "55d24ff3-59d3-4e88-ab58-1e9b5d2427dd", "comment": "Malware payload (Dridex)", "value": "54dee7474989595ff6253c613aacfd36", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486046, "uuid": "adf4919f-135b-47ea-baee-62e22c203d24", "comment": "Malware payload (Dridex)", "value": "59dd80624b05e445100f184fdc625f0750930aea20e432c4dd72cab2ee82d6db", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486046, "uuid": "5e7edc8b-a77c-4986-99d0-c2c8301239df", "comment": "Malware payload (Dridex)", "value": "a3a862608cb75036954a4bc61d4aae8bf302f288", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486046, "uuid": "03fdae56-67c9-4f8c-9cd5-310c4aa69b1d", "comment": "Malware payload (Dridex)", "value": "97a063cf3ee4f912e289818c86b4dadacaeef635a216123ba31a55ee2564cbe35b5db9abd6023b580d1fb5de6e7804a8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486046, "uuid": "c1204abe-0e94-4379-9405-9007da478010", "value": "B3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486046, "uuid": "3e3654b7-fea8-494f-bd68-d9035a96bc2b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486046, "uuid": "76779f70-9473-4dc7-8ba6-9c27e36ea37d", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486046, "uuid": "1f4da73b-9d21-480d-988a-39bed6503819", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486046, "uuid": "8efa4605-c16f-4b5d-ad75-5d9129108eb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486046, "uuid": "ac1c0268-1d2c-414a-98bb-3ec607ad94eb", "value": "54dee747_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70429c54-b038-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620504201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504201, "uuid": "51b347f5-baf8-4c5f-9f55-59ea1d511250", "comment": "Malware payload", "value": "3866dd9bd35f888dde8a596eae81d3e0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504201, "uuid": "b63f6c49-2785-447f-8868-9a29b7dac774", "comment": "Malware payload", "value": "59f875631b2bd2e7a50b074057ae7492ad99b3beb6caa69abe0bce9d88675d71", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504201, "uuid": "a12f9c79-dd82-4f85-b3d6-d9d3afa76a67", "comment": "Malware payload", "value": "7d0fe7b752ed397d53e2e6fa5f1fc147aae8fa06", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504201, "uuid": "a9ba1acd-938a-4bab-bb9a-6b0f10bad70b", "comment": "Malware payload", "value": "5acdb95b267ffb763f104f2775171c091c3e91e0bf2ef39d912d527dcf6016c947d95ad6ed5c8bcac844bcf9cf9ab2ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504201, "uuid": "1974e014-8818-445c-9ad5-01dbf4f986a4", "value": "7CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504201, "uuid": "d230517a-cdc9-4ce2-980c-a6548f6d2ee4", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504201, "uuid": "ba2ad704-7fbc-40be-b387-56e2df5fc7dc", "value": "3072:hlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:hlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620504201, "uuid": "710f7b1e-2387-4fbb-94c4-16b52efc77ba", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620504201, "uuid": "e087aec6-cfb6-4379-a8b5-491ba59a6205", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504201, "uuid": "1e1dc992-6641-4cfd-b923-5220444eefaa", "value": "3866dd9b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb66858-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471662, "uuid": "23ddbf7f-6a89-493a-9cc4-3c9dc7ccc555", "comment": "Malware payload (Dridex)", "value": "8ea35ceb9eb28dcb1da29fbe61988a6c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471662, "uuid": "9dc9cf3c-5a15-4b6a-93d2-e442110d3239", "comment": "Malware payload (Dridex)", "value": "5c6be07e531e1ad9658335053ecc1ea859aa3b3f721d00ec590d037627d0fa5b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471662, "uuid": "9cc6a032-0084-460e-b834-f5929b9ecbe1", "comment": "Malware payload (Dridex)", "value": "5e5b83c566e7e8adf3127d4f0452512e27bb7396", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471662, "uuid": "9bba672f-8363-4459-a6ee-862e3cf2c68a", "comment": "Malware payload (Dridex)", "value": "7812fffec25e9c63afc74ba857ec42034a122d3093b41d75843b8fa814a8da2849165602bd32dadd03ee61e9cd2ea650", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471662, "uuid": "ed6cb6a5-38fa-4a51-af8a-82d5d2064596", "value": "3AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471662, "uuid": "d18991d0-4933-4b8e-a426-f8c75224eff9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471662, "uuid": "8b68e7ee-4d42-479a-b65a-ab7dc2389b7a", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471662, "uuid": "c13d1ccb-81ed-4712-814c-30bcb9b1a556", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471662, "uuid": "c19ecce2-ae33-4d89-ad04-288519e878dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471662, "uuid": "b0d49dae-e9ae-4c7c-9c3b-ae97718b6890", "value": "8ea35ceb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab05b63-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620468060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468060, "uuid": "f153fdd4-23b0-4619-980b-eaff7af77658", "comment": "Malware payload", "value": "4a184634bce5bdf9965b9761a1d4fca1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468060, "uuid": "46b15043-2a14-49d5-aee5-6de2285d5331", "comment": "Malware payload", "value": "5dc9737a534b4dcce27a1f8a113e60f643f5bb4d3ada89b832736f72c5cd36b2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468060, "uuid": "ced1a999-a32a-4d42-a5cc-9052826374f1", "comment": "Malware payload", "value": "32a912b7439037c423573b6ab1e32c1a18da1761", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468060, "uuid": "c595f62e-18ad-4640-ab93-3fff3b749295", "comment": "Malware payload", "value": "925303b9d6efbd0f92ab859850fc1fff49b90fed8071dd161a7f0642b0dcf1b1d552347d4cc39ef03f795b6c130611c9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468060, "uuid": "b0029446-6235-45ee-bcb4-8270e023c05f", "value": "23F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468060, "uuid": "5b366c00-c87b-45d2-9e5a-874929346748", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468060, "uuid": "2d380f19-7725-4d46-9837-1c268f80b416", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468060, "uuid": "fea25324-2ac6-450b-9e61-7c0abd84da3e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468060, "uuid": "ac11f182-4ed0-4700-8bc3-6b5de2f8f7d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468060, "uuid": "3e4960ee-f1c3-4596-a830-2354b656c4c8", "value": "4a184634_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f092a7-afa1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620439267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439267, "uuid": "7b0d6cd5-f71c-4580-bacc-39b0b1270879", "comment": "Malware payload (Dridex)", "value": "8b55dc8ee88a01a7ab13cd96607c67d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439267, "uuid": "31f40d05-0bd5-4a25-be06-6cbb9fd38468", "comment": "Malware payload (Dridex)", "value": "5e194b46d5fce93fc3051d0c488c627d6a125bf0788eb7a562bc6a166f8bd60b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439267, "uuid": "6c87ed5d-d946-4b11-9958-f83a8064d197", "comment": "Malware payload (Dridex)", "value": "c0bab0b5c3589cc090515e9d6c42fd852c65cc70", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439267, "uuid": "bee9984b-3051-4700-8c75-8802d2fb7279", "comment": "Malware payload (Dridex)", "value": "b9f3a10e6ddcc412c1f8db7f4a777bcc17c89ce669aa13056e23cacabb6c60a63bca38dce4e2cc580101b86cb8e82b0c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439267, "uuid": "92f77da5-aa00-42db-8220-cc5b85c3beb6", "value": "FAF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439267, "uuid": "3239c6ad-6028-4669-8bd9-5c5a825fe0e8", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439267, "uuid": "6622936b-f052-4e9e-8a4f-c51241ed1e99", "value": "3072:iA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:i3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620439267, "uuid": "4e6e33fc-8e2a-41cd-8dde-20f28f8314c3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620439267, "uuid": "388aae71-a315-45c8-aab3-2c03f17688ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439267, "uuid": "1f585083-14c7-4f00-829e-5fb35d6fc047", "value": "8b55dc8e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49bc1c8f-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457321, "uuid": "851d12d5-439d-4ae7-a7a0-f5b3e5e70053", "comment": "Malware payload (Dridex)", "value": "161beb070411154335d13824b4db1c21", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457321, "uuid": "bf8734cf-5c88-4903-9437-30a35320f0ec", "comment": "Malware payload (Dridex)", "value": "6038162f65a07db023a156bd4290d4f423dae7f394f375a35b040868bb1a0e79", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457321, "uuid": "5d9fa3b6-5136-49d7-bbb8-68d73c852d50", "comment": "Malware payload (Dridex)", "value": "8e099c6b5948fd902591c0cf8d2980b026ecf92a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457321, "uuid": "b8a6588e-7712-4244-835c-f0996e555884", "comment": "Malware payload (Dridex)", "value": "db674278bd943d633df8b317f0500306c80a425156bcd983aa28f576c83a8ca09a301fc98e7578888b78f1037df90c2f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457321, "uuid": "1a940d9c-c432-4320-910a-88f13c5f0b2a", "value": "8BF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457321, "uuid": "0d6fa231-9ca1-4080-85a2-d2eea27c2b99", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457321, "uuid": "dafba704-6971-4432-bad5-93df7b091826", "value": "3072:Hlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Hlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457321, "uuid": "8c80fe80-e14b-408c-a225-003ace01daa7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457321, "uuid": "a3d16765-17e3-454a-b7c1-5c7bae7b8013", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457321, "uuid": "f5cc834b-e49a-4541-8483-dbecf303b898", "value": "161beb07_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904a2d03-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442837, "uuid": "98bc7379-8b1a-454e-a199-c825a51cc91b", "comment": "Malware payload (Dridex)", "value": "f84ed7973380e6187429aec6e6664e52", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442837, "uuid": "6563f431-9df7-454e-b82b-caf2ae18c793", "comment": "Malware payload (Dridex)", "value": "604a17568b99c6b391bda0379bbecff92ae93f67d7a6096707865847c2d57f83", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442837, "uuid": "614aee8c-1d01-42c2-9d57-0cb3fcbed5d8", "comment": "Malware payload (Dridex)", "value": "b7dac905ae057e32bc03ae2569d95f60d33c70ae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442837, "uuid": "3f6f710d-289c-4f16-8b9f-6d1f564c591e", "comment": "Malware payload (Dridex)", "value": "cbf4d99e56653dba92231b38a260d8018e40adda4303882b33c92febc962c41bed219ea052375b876eac4375eca666b6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442837, "uuid": "051c050b-7e15-4f24-81da-bde44c7916b7", "value": "EFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442837, "uuid": "ddf93a00-1201-499c-9584-206b8ec56d06", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442837, "uuid": "d54c217c-c467-45b7-b9d3-9f571bf81147", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442837, "uuid": "6f6519fc-e6be-4125-898c-3ecc6c8fbd7d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442837, "uuid": "feca1116-b5a4-4857-aafa-57503b2cbe7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442837, "uuid": "322c240a-fb88-473a-a0da-e987fdef31b4", "value": "f84ed797_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955db0c7-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442845, "uuid": "d7b83bfb-32ee-4afd-9894-247057e31594", "comment": "Malware payload (Dridex)", "value": "54ba27917249dc1222b58f1a12bc3885", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442845, "uuid": "ee9d6936-1d60-4875-a2f0-03d38bbc91ad", "comment": "Malware payload (Dridex)", "value": "604eeb4c1eea2a5d5637a88683c77c6a457a285b11d5469d1fab53e16051914d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442845, "uuid": "a89d9b97-bf76-452a-9976-e2d3a4f9ee95", "comment": "Malware payload (Dridex)", "value": "b649047b593c07f8b7e0bf8b45553b6c1053009e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442845, "uuid": "eb18674c-171e-44bc-a55e-ce72c4ccb80f", "comment": "Malware payload (Dridex)", "value": "212c5bb64ba26b78cca31ac405993db66edc666557668d19a47431abe419b6faa374f975382ec4150d3337680485686f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442845, "uuid": "1dc0a3ea-70b0-4c83-b65a-e7bd570c2910", "value": "82F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442845, "uuid": "aeb31f75-5816-4b4c-9570-1e5a769d0bad", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442845, "uuid": "78703562-6d02-4de5-b54e-5866265c1a51", "value": "3072:ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442845, "uuid": "3251f725-b7d5-4b84-9f5c-7e2cd357bfd7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442845, "uuid": "f33447f6-da45-45fe-9a9a-9d534dd20738", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442845, "uuid": "05a16f46-f138-40d3-872e-93f18914e954", "value": "54ba2791_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f4f5d1-afca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620456865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456865, "uuid": "ab07747e-f7fe-470a-ad75-6d12a7526e72", "comment": "Malware payload (Gozi)", "value": "3caed8793a6444ce411bcb88f5f661a7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456865, "uuid": "0119befe-9565-4203-8ac5-119924b6bc49", "comment": "Malware payload (Gozi)", "value": "60aaa4687dd3691cd748aa4ac21324049698f184afa7d9a479f7527895dc810f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456865, "uuid": "55100115-eb24-4a17-a4e9-1b9ca26311d5", "comment": "Malware payload (Gozi)", "value": "eeaf102a8062dd544755edc24c4cd9e57bf07864", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456865, "uuid": "d437bd76-5bb5-4dd7-b9cf-36baa8e656e7", "comment": "Malware payload (Gozi)", "value": "470d1006c117346051a915fa4aa1e2330d00015988be68f69d4fa6d44179fb31bea22f4eab1923030b0ae94c6cf62328", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456865, "uuid": "ae04d993-59a0-4eb7-8da1-8e35233abd18", "value": "3515C03138C1C232D573A0780A69D6B04BADB4301D359B9F77DC2B7E6F715A092369AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456865, "uuid": "5f25d711-253b-4cdb-a819-01f8778901b6", "value": "7a79d10b1d4343a18a4f6e25e165b4ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456865, "uuid": "3ccd7085-c26c-4e41-9151-44859b3ff72d", "value": "24576:HQfpzjXPgfp8CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDgNJV4OaIRj150CpNiLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456865, "uuid": "6e65de6c-05d4-4aac-afbc-76ecc1546223", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456865, "uuid": "95a795ed-cf29-4485-a068-0aaf18c8dbc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456865, "uuid": "df4a2319-a1cd-48b8-b870-e5b40a2ddd38", "value": "3caed8793a6444ce411bcb88f5f661a7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9acfb8-afbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620451236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451236, "uuid": "d4119123-f47e-4f3a-b97e-aa2ba6616b42", "comment": "Malware payload (SnakeKeylogger)", "value": "a3aadc97039f85f40f8fef2522d23116", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451236, "uuid": "6f5de1f2-8c1d-4d49-8da5-ef2d4ad020da", "comment": "Malware payload (SnakeKeylogger)", "value": "60c51de032d9f139ccd9f4dcbbd88f4e3911ac496042fad636c1361daaf71a48", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451236, "uuid": "94ca935b-5ac1-4ffd-8d17-235b0bd39c70", "comment": "Malware payload (SnakeKeylogger)", "value": "691c37d5ceeacac4b8a6889909de307db83b5157", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451236, "uuid": "ec85d22a-07c5-430c-a9a0-1c647d4b2966", "comment": "Malware payload (SnakeKeylogger)", "value": "7070dc64c8268c43cad5565b3d42bbdea14276c889e85d53d0574bc22a1a71c9a076732fbe53b074f84d94145dd80825", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451236, "uuid": "2ecfff63-94b5-45df-a1eb-4a031e51332b", "value": "DBF4336E6DD84C709ED026F3976943870CDC6A2891AC5177A232690437BEFDD148FEE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451236, "uuid": "2d2b4dd4-bed5-411f-abc5-689a1162dad6", "value": "12288:/HXXJrsJr0pZ7j+HJ9bw6vacc5uOHsq/8vzlQIyyQ+svFnT0UYtdtdEKDVycvpVA:/HXXJrqr0p5wJ9FvacQuUsy6lQOjshTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620451236, "uuid": "3ec92ac9-2849-4b3c-819a-05d140ef9f33", "value": 730718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620451236, "uuid": "033b7638-9abb-4824-ad2c-c7e00f70791a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451236, "uuid": "c53fcb54-0ec9-4f1f-8857-b020c06c50c5", "value": "Invoice_20210204.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f3c064-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457375, "uuid": "2d50eb3f-3376-4d16-86b0-492de2e4d3cb", "comment": "Malware payload (Dridex)", "value": "6d2594c783d57ecfb51b173dc9932226", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457375, "uuid": "b6996f35-cc18-4335-bd35-6f03afe2a42d", "comment": "Malware payload (Dridex)", "value": "60d43f0a5443c17bcbbbf51b6e832c562444d447b6cdf0cd94f9af8782697646", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457375, "uuid": "c5ce7427-3064-4586-a882-0d3ed4d1e6b1", "comment": "Malware payload (Dridex)", "value": "7ebad123418bdb21ec186350a3fa42a21b9b0949", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457375, "uuid": "5496ef19-7ab2-4fe8-8042-d80efe11e8d0", "comment": "Malware payload (Dridex)", "value": "ead99ed3b15cdd69c743f9e9454b6b6c6dfd5f3b5395a3845c576422ec61509bf1573a46e9eb18d392ffc60e4e043e9e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457375, "uuid": "9ee200df-0f2d-4ef0-804a-619d5ba06a58", "value": "A2F3E00AED9FE988E85C51F1CA4D363EE9713E361B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457375, "uuid": "9d3846b2-8691-4218-a7a5-9f6c6b1b05c1", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457375, "uuid": "4afaeea5-75a3-4f30-a619-50c1e663e33e", "value": "3072:QiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:7eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457375, "uuid": "75802af3-ef42-42f5-ae98-ca29bc67d2e7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457375, "uuid": "6be7b5d8-8e3e-4ffb-9bb3-cc1fbd8ae37e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457375, "uuid": "cdfa7a97-18aa-44cb-b062-6b0272731277", "value": "6d2594c7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1045e8d8-afdc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464526, "uuid": "79219fd6-82d7-4af8-a561-3f9a2f26ea2c", "comment": "Malware payload (Dridex)", "value": "6afdade7a0ad555df7d755723fc10395", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464526, "uuid": "7b8816ea-af7a-4f85-9169-2d452a5521d7", "comment": "Malware payload (Dridex)", "value": "60f7ec18f6a88b91a1bd17d4fcda4be2e6c2ff93e04b07a4b47d5a5361651de5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464526, "uuid": "37d20783-ab34-4d54-8328-37d893df7313", "comment": "Malware payload (Dridex)", "value": "b6486cf67b7aaee4d1d517ee658b9660622a612b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464526, "uuid": "ab628f91-e631-4bc2-b57b-85cad23c64d0", "comment": "Malware payload (Dridex)", "value": "fc7266533ce5254153c344b845743365ac210baf7ba3078608ca6d00fe24967f6a9a791de872f89ee6c92b982f9f681d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464526, "uuid": "c2e686e2-ad14-4836-9e1c-bca353b33f6a", "value": "67F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464526, "uuid": "2dc60073-3f25-4b12-8433-69c245069427", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464526, "uuid": "9ec52c29-cbd3-45b3-9202-c44e53f5e69d", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464526, "uuid": "97b46cac-b274-44cd-a9e3-3729ed8644e0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464526, "uuid": "f5e4316a-c622-4c74-9dff-0609da5eb0de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464526, "uuid": "db115319-ea93-436d-a619-d68dff8d9a24", "value": "6afdade7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a2ddc4-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620475376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475376, "uuid": "7a31186d-46a3-4634-a83b-39502e9829f6", "comment": "Malware payload", "value": "6fcdaa9bf8e2042e2df89e2428a7de54", "object_relation": "md5", "Tag": [ { "name": "i586", "colour": "#9E968B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475376, "uuid": "bae7880d-f8f5-4e40-95a6-1e53dcff300a", "comment": "Malware payload", "value": "6102091907a7587da8796311a897d095b589d8c397f5a639dd64cce929afc5c6", "object_relation": "sha256", "Tag": [ { "name": "i586", "colour": "#9E968B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475376, "uuid": "78f41387-0625-48fb-b4ce-5f9ce2d3fbe5", "comment": "Malware payload", "value": "c3a2f58464323e0f8f9d90ca170691b216faa3f7", "object_relation": "sha1", "Tag": [ { "name": "i586", "colour": "#9E968B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475376, "uuid": "1c59eb2c-872b-4f13-ad84-e9209a5e060d", "comment": "Malware payload", "value": "a758d42c39634394f46a53599c0092fdc508eb603920fc84becdbff5435dbbee7ee0864d9749dfdb3dd37efdfe3ddcf5", "object_relation": "sha3-384", "Tag": [ { "name": "i586", "colour": "#9E968B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475376, "uuid": "89dbeb8a-600e-4b43-83de-c86406ae6bb8", "value": "3F03F1D28276C78AE10D52774CAF390FDA326A599210C617FD88382614D67339FB9BC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475376, "uuid": "6289cd23-2c5e-4f8b-b5fa-cd14effc55fc", "value": "768:imfriHzafJrYjn7hK886z8cn2mrubnbcuyD7UyQRjT0DFXI4EcCiL36:5friHYk7hn8OnFubnouy8yyXApI1c736", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475376, "uuid": "55044e3a-6660-4738-a339-7514f6a22f9c", "value": 39292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475376, "uuid": "3db77e6b-fc9b-48f0-a992-d515b915b722", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475376, "uuid": "11026a6b-b75b-49f3-9644-1b1d0c474dd5", "value": "oFRAN.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c6661b-b006-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482581, "uuid": "b131eb58-dc27-4d49-845f-17e5c3fd29f3", "comment": "Malware payload (Dridex)", "value": "d1bcd5db82a681aadf13a1dbb8104c1f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482581, "uuid": "8382cdf7-07d8-454f-bc3c-68eb5cf45c45", "comment": "Malware payload (Dridex)", "value": "61c582fb1c854f9f6f8085180ced197d9dffbf012b082597c118f99a6f800e6e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482581, "uuid": "61dd95c8-8059-4ebe-85a0-2380ff74dd9e", "comment": "Malware payload (Dridex)", "value": "170c3f61c4565c80b901af93ae8a8fd78987f691", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482581, "uuid": "c7653a55-8c38-45f0-a9fe-c224e6b8de92", "comment": "Malware payload (Dridex)", "value": "a2e09942ab04bb5829fa946f1426cf4b9ecd30ac5655fc2f87bf1c576d22c4e5d10ae9a82812c929db3ceb7b5ea25eae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482581, "uuid": "2ac4ec25-f332-4f75-b0ee-89e37187d577", "value": "59F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482581, "uuid": "ab9eba28-5782-477c-a694-270a7aa35b38", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482581, "uuid": "afd85b13-e58b-4ab8-8cdd-e7517ac20e88", "value": "3072:YWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:Y42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482581, "uuid": "f6750b13-e236-46ca-b3b9-0f5abf01c8c9", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482581, "uuid": "60fbec08-190f-4711-8d60-a4d8f3c969de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482581, "uuid": "9fd5bf7d-9d4d-4f3f-bd4a-5120d7341e9c", "value": "d1bcd5db_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678d0e50-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457371, "uuid": "d20c04cb-7608-4a0e-b14e-2be4301f5177", "comment": "Malware payload (Dridex)", "value": "472d6d73e4cfe0dcced23e5883d4af14", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457371, "uuid": "cdd4399c-ac1c-425e-a66d-5ea892c20efd", "comment": "Malware payload (Dridex)", "value": "61d3826917100a980c601d56240bf3c3dcb5f595cbd03b22620d10ec1160aa72", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457371, "uuid": "958a0278-4fe5-4a5a-be70-618e8c2167f5", "comment": "Malware payload (Dridex)", "value": "700e64eb01ad998a2a971a940a339d37050c71e3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457371, "uuid": "7281a0d3-cdc0-44f0-926c-f5d0b013c64b", "comment": "Malware payload (Dridex)", "value": "3c42764be8beccc65cf6c650170081cfd12a9d1d03c7824764fc14060ea97f8c984efdbad9ef4e4f39bdfb6d0dcadc08", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457371, "uuid": "89797da0-f0ef-4e3c-8b9c-7d711bb38b1e", "value": "C8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457371, "uuid": "b7bc9d1e-614f-4118-a90e-079020acb545", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457371, "uuid": "f3390bef-e9fc-4890-86a7-e827669f4d19", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457371, "uuid": "46d1a683-278a-4529-817a-2f6e941600f6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457371, "uuid": "631fa348-a47a-47ff-a723-74bcada69f4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457371, "uuid": "274c4e24-532c-4293-8cb8-53883f947e3a", "value": "472d6d73_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f98a26-afd6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620462225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462225, "uuid": "2190011e-f3b5-4bb2-81dc-bc1e22ed028a", "comment": "Malware payload (AgentTesla)", "value": "3647a16c42739a2dd20766d3b30f3e8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462225, "uuid": "3782aceb-c1b3-466c-9535-ad6b266a13a9", "comment": "Malware payload (AgentTesla)", "value": "61d4edaefe2284677133dafcaa9dc45834e503fbfe190e7e7d3de98e323da590", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462225, "uuid": "d2460a94-b6c2-4854-a769-756de9058357", "comment": "Malware payload (AgentTesla)", "value": "c4d29734ab238e05a60ede9c3987c1ea1ded2dd7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462225, "uuid": "b54c7bf2-ffbb-497f-88b7-87d282603417", "comment": "Malware payload (AgentTesla)", "value": "6c95c0fa135bec3bfc17d91015adb58fa670dfe9a86c6ccfcb7d82faa192cb7063c41c50ad08e36b9eac80dcae25a714", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462225, "uuid": "33ec6c54-b3d3-4c18-86f6-e08cbf274dfa", "value": "66058DEC755465F0E35B5D23B3CF1C0642252274A93BAA0E8B6013BE5A67F133E3998D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462225, "uuid": "ea14f32f-15ad-49e6-ae80-ef2352b1d554", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462225, "uuid": "84b2fd52-eb5b-46c4-9e45-752c2c2f2564", "value": "12288:6EcH1oLLoS60/K7yh0vNANWPwXI9SFNpXjaY0yO+JDqz9Vj62:y1oLAvNhSFHXJ5DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620462225, "uuid": "0cb4454f-2035-4e0c-a8f6-d4450f982af3", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620462225, "uuid": "acd87bce-8145-4614-862c-e6182a22c8fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462225, "uuid": "52e0bc54-1342-486f-97db-3a848f807013", "value": "DHL VOUCHER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b884e33-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471632, "uuid": "dcbf8037-3d9c-4fd6-af30-4dad4769c6ea", "comment": "Malware payload (Dridex)", "value": "aee2b55c50a34c6b2643d43b056f9c93", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471632, "uuid": "071248f3-00f2-4f6a-8c32-54d380877588", "comment": "Malware payload (Dridex)", "value": "625527fa5dbb1e5098bb712d7cb3a817b3c820a4904ea6c5d125f29eec080a7b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471632, "uuid": "bda56b41-d1f6-41c7-86ae-505602558981", "comment": "Malware payload (Dridex)", "value": "54ea5e44718b0b6288cc3748434a4712ccd0baac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471632, "uuid": "895822f0-8a7b-41e5-8c28-602769f5060e", "comment": "Malware payload (Dridex)", "value": "e9deaec5111f5bd20a3fc3212c2b9f86063a0a13c2cb40a4f604bd0fdef593e8305a6c306115b3d004b9ee206039405b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471632, "uuid": "8b958565-eccb-450b-aa3e-1eee1db4893c", "value": "21F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471632, "uuid": "fbb30942-19fe-407c-aacb-7399150c7535", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471632, "uuid": "01d1e184-9379-40aa-9877-68b3e5abab4a", "value": "3072:dlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:dlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471632, "uuid": "22459496-3a4c-4900-ae90-dc51afeb053a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471632, "uuid": "d97daa8e-b8da-4ff4-9801-708c49efb8c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471632, "uuid": "6497a680-27aa-4d63-9a1c-9834ac51644c", "value": "aee2b55c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1824acfa-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475277, "uuid": "c20d087c-58fa-4a53-99b4-6088171be98d", "comment": "Malware payload (Dridex)", "value": "64086385d3c3ad893508b33b29f79ef2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475277, "uuid": "ea343da4-85dc-4ef2-8afc-de69c832f842", "comment": "Malware payload (Dridex)", "value": "626696060974970820ce114bd64eb10dd43f0340ec13967667ef2c105897c2a7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475277, "uuid": "0a4b88a5-83fb-48c5-ad96-7e8bf4364206", "comment": "Malware payload (Dridex)", "value": "f4d762577f1e1f5ba960601262552f127200bd4f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475277, "uuid": "57de4aa7-6a72-4e07-bde4-0c5c15ce5ec5", "comment": "Malware payload (Dridex)", "value": "be9722990c3d50c58e11d7a53c2f8e6e767bed0de81529eff0a0eaf579421b0a0e4664d77ad34c8071a1ef16fdd82d5c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475277, "uuid": "03f08983-0c8f-4032-a6ca-065e5954dca4", "value": "DCF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475277, "uuid": "c9d0056e-5dbc-4bb7-a29f-5ca3aba7a9f5", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475277, "uuid": "34c18d69-fab4-4b4e-8282-8755a80e3018", "value": "3072:Je45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:44KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475277, "uuid": "85c48b0e-5163-4539-8f2d-f345a9a5fa84", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475277, "uuid": "64d451cf-9d36-495c-a604-4bdb3591205d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475277, "uuid": "240d985c-5e81-4399-87d2-846cdd78c761", "value": "64086385_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1048180-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435644, "uuid": "8a6f7c07-a2e9-4ac6-8227-b5c9ebcef999", "comment": "Malware payload (Dridex)", "value": "1daf6773298b8bb6ac50c6ab830b4d47", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435644, "uuid": "cadf28af-c166-4ec4-a4da-7ed8c0a6798c", "comment": "Malware payload (Dridex)", "value": "62880c752456f50d9bb8ba90b85b9f3fd02d41fc814f9e264fb0a6efef9969ee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435644, "uuid": "d3c666df-4c8f-45d0-ae02-d34a9c1fddf4", "comment": "Malware payload (Dridex)", "value": "693fd169e1feb4008a516fb8dc97819e1bb45983", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435644, "uuid": "6eb5c101-13e7-4cad-ace2-ef0da2be01f1", "comment": "Malware payload (Dridex)", "value": "0511c6b8b6e17f03d7122cfbc7b077f70c3c4fe2a2b3906aae2094c71408210470f6750b27ab9a20c247f20f4c9c8d1d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435644, "uuid": "d9bc9c8b-7777-4364-8ff8-a9ed167f294d", "value": "E9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435644, "uuid": "fa5e2166-70f9-4fde-a244-8c772efbe58b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435644, "uuid": "e873fec7-dfbe-479d-99b1-8e9fb5963417", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435644, "uuid": "4d70035d-de1e-413e-826c-9036c01e5c1b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435644, "uuid": "b2d28a33-70ef-4027-ad3b-0d269403958f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435644, "uuid": "0d293e42-a230-40bb-96dc-2b3810362adf", "value": "1daf6773_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "872daf4c-b029-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620497797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497797, "uuid": "102ce294-a953-4b77-9dce-91f1a9301a33", "comment": "Malware payload (SnakeKeylogger)", "value": "1e2eb72a2523a9cf4a587dabf1e8492e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497797, "uuid": "42bd3463-f215-4008-8b8c-d1264ea2da6b", "comment": "Malware payload (SnakeKeylogger)", "value": "62881ff4b0c01570c37e2bdd9a38875f28cf608d803877fd68d592b51cae3fd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497797, "uuid": "ac572c5f-740b-4213-96c7-4f3dc9f5fa0a", "comment": "Malware payload (SnakeKeylogger)", "value": "ae6db72fafd3499eb3214338c4df67b27eb6182f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497797, "uuid": "580e8165-6acd-4c2b-a64a-aa8cef75b7ba", "comment": "Malware payload (SnakeKeylogger)", "value": "36ce2fafc595a93624cb0c967c09122bf52c9b7f562079dad0ae02cb9e25ab61829a2731f1e644d2945b6bd6bbdd66d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497797, "uuid": "1183ea69-1aea-4dae-a194-fc5947e99a3c", "value": "D0E4126C2BFC6F14C5FEEF7429F040861279B4479853E32D59E821F56933BA08A163B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497797, "uuid": "8375f3da-87e8-4c1e-8c18-b137f8712bde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497797, "uuid": "ab73cc94-cef0-4d8d-a904-7e6e5ba562a4", "value": "12288:fNYtvLp/2N+58RROkqSIF6fHLRhJLo4ht2oE045cX2j4MG2FJXRByHYyowM:lCvLp/2N+5rkqF6fvJLo4h74XcMXFbBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620497797, "uuid": "1cffc892-05e3-4e50-a476-21adcb4f4527", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620497797, "uuid": "2c24a3e0-cdbe-4257-910b-7c99fee699a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497797, "uuid": "d25bb64e-3663-4cb7-bfc3-a09cfdb96c0e", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56401f17-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "a4d58cc7-9ef3-461e-9322-85c52014aeb8", "comment": "Malware payload (Mirai)", "value": "605529fd2feeb4b29a7ec43e41c66cfa", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "4d6f79cc-5daa-41bd-bb08-9af241d42042", "comment": "Malware payload (Mirai)", "value": "629af4cf5e6f9beafa3b83f4c47667d0dcc75abde94b6b99a518faf809287b22", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "743a2d4f-c078-4cda-bcbd-32b9e02d0368", "comment": "Malware payload (Mirai)", "value": "97b01103d22585af11237f5c9423e50fca6131f5", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "dadc4710-b893-4120-ac8b-34310d72439a", "comment": "Malware payload (Mirai)", "value": "9a6503e6593ada985d017b69717897729f71ddd5f243d0897b423c63ec89547ce1534f6a2b4c32bc23519b9442df3962", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "f27936da-c549-44ec-843c-a8ef884f08b0", "value": "49232A8178929913C6E4137BFAAE41CD332567A8E1DF32178D222F4577CA82F0DBB651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "43a4b644-bf2e-41b9-983e-39bec1ef7f7c", "value": "768:3T0rXDuL8QEWbtnc33mx9ogaPXxRyDRcEOjUhl0uwVoVMscG37LSS7Af8PN+88jc:grILEWpaPBRytcEOAl0c3LLRQCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475381, "uuid": "a51462f4-78bf-4a1a-8f3a-79d03d0bcb7a", "value": 49988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475381, "uuid": "69a4b7f5-31ee-44de-9b0e-3ef59d067c8e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "21b4f21d-639b-407e-93d1-a983354aff9a", "value": "Winbox.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aadad3c-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457349, "uuid": "da7c4620-c588-4ad9-85a3-3aa738ad1b7c", "comment": "Malware payload (Dridex)", "value": "55abe4c265d2f7dc9680e1df04d5f433", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457349, "uuid": "cd7c9929-9529-4e2d-bb70-ba88a29aefd6", "comment": "Malware payload (Dridex)", "value": "62bbd23e9470d71ca2c2ea22fc5fd106feea006edf3062ce2223d0f3606133bf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457349, "uuid": "01c42da7-0251-47db-b87a-b1a83a3ff686", "comment": "Malware payload (Dridex)", "value": "2563be43acf90020d769422ef7a3e29a61fb102f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457349, "uuid": "40ea0d43-20a7-4793-a5af-6aac4c97231e", "comment": "Malware payload (Dridex)", "value": "073506ebedb4e29a759fdc504926b97504bb08c4290b19f0b9f3c357d443e748b2f59e995d7296b47684bce8fb7b8111", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457349, "uuid": "b5db020e-654c-4018-86a9-aaf1552531f4", "value": "3AF3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457349, "uuid": "146204a2-27d9-4a99-9a79-b1cef00fcc02", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457349, "uuid": "43e923e7-4fdf-48b3-a3af-f7f9154bdad7", "value": "3072:luFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:l0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457349, "uuid": "1a45240a-ab3e-4aaa-aef1-ed65e93c1180", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457349, "uuid": "7a10da97-df25-4c1a-87ce-4610212048af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457349, "uuid": "000cdd64-56be-4d22-8a5f-34c5cd90bbb9", "value": "55abe4c2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e534f4b-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442860, "uuid": "14373d1d-b87b-441a-9632-0af048cde1aa", "comment": "Malware payload (Dridex)", "value": "24846d5312b6b0b2086b4d5036208e1b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442860, "uuid": "12007e20-ecaf-4d13-8775-40de4b4a2857", "comment": "Malware payload (Dridex)", "value": "62c2c24e6038b484e8a82bda9b3ad81958b667c435ec36cec4b9b67b1610672d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442860, "uuid": "c763bed5-9874-4bd6-899b-082f95f72c9f", "comment": "Malware payload (Dridex)", "value": "e2b8a7f3bba09a3935ea0407f7e2933d0cc7f397", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442860, "uuid": "19955ea8-ca50-4ad8-b9e4-83ee6e61a4a0", "comment": "Malware payload (Dridex)", "value": "33c5b16f031b14e4fbc215aa0cb78b3aee36e904fff0101efcf4fe9d53a4b7ef87bdfb7d23ccf43bd588367d5dd7a353", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442860, "uuid": "3a912bdc-bb89-4c7f-8572-445143c4dd1b", "value": "CAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442860, "uuid": "280cd902-2541-4f34-aa47-5a3bcd011b1e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442860, "uuid": "d3acf112-6d05-420b-9997-1f5ba3a06ebe", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442860, "uuid": "dacc28a2-2bd4-4eb6-9468-f74120c17367", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442860, "uuid": "a6c8b3c1-7946-462c-b92a-0ba3672e6e8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442860, "uuid": "9bf66d39-d253-4eed-b302-e0cad01daadb", "value": "24846d53_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56cc20a3-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475382, "uuid": "9239a113-4e3f-491a-a1b9-fe829b62ce3e", "comment": "Malware payload (Mirai)", "value": "0f45954dd3daab18f09098146d16a36f", "object_relation": "md5", "Tag": [ { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475382, "uuid": "f7326454-61cb-435a-ab58-84f871c9abaa", "comment": "Malware payload (Mirai)", "value": "63841c16fcae3db333206651b4b6a4cd7d5b4c9bd32aa9d71ef46b663c1ef075", "object_relation": "sha256", "Tag": [ { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475382, "uuid": "b246ef84-f409-45e7-b295-dc4f4d46a764", "comment": "Malware payload (Mirai)", "value": "ed6c3a43aca28bcaaab226b2a06da543bd4d9a41", "object_relation": "sha1", "Tag": [ { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475382, "uuid": "bf032063-b16a-45ca-9b13-ba8a3abeba96", "comment": "Malware payload (Mirai)", "value": "57bbaa302447aaf43f8499e36e6e848a5da739e5f6da3603365f4576a4cb015f61a524b93294fad73a25ff667514c7d1", "object_relation": "sha3-384", "Tag": [ { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475382, "uuid": "82d442b9-1e84-45ea-93af-6a049fcde743", "value": "E42319D6B4029D3CF81FE6BE94120D18FA61371551930B2B67ABFDE37C321686D12E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475382, "uuid": "fd4d570e-0b67-4f73-bd54-f4e38b03c402", "value": "768:JDPhjYWQI6QhU4uMpYaAD12CEX7cCyJ08bw9reVKS8Vy:R9YWQIRhUz512CELcP08bwxeVN8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475382, "uuid": "2f7eb91a-3aca-418c-8a60-2fd327e01b5e", "value": 47316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475382, "uuid": "7c19c604-527c-4f79-9a3b-d3164ef170d3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475382, "uuid": "cc4bd38a-f966-411c-b031-8373afaefd61", "value": "Winbox.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4eb21a0-afc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620456266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456266, "uuid": "76ad1c2a-41d0-4d5c-837c-47e3fd901e46", "comment": "Malware payload (AgentTesla)", "value": "9226944711bda8c47266dd2ebf16b35b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456266, "uuid": "c3ba07ca-5ef9-4a45-96ac-46f801df700d", "comment": "Malware payload (AgentTesla)", "value": "64bcb08d9f06b5c5600909d36baad87712db0b22befcd3e1e4a1dd8a3938301f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456266, "uuid": "836dd555-8d7a-414b-9f32-a1a9fce56a3f", "comment": "Malware payload (AgentTesla)", "value": "77ae557ae33909a3c4b98dd431945125424a95eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456266, "uuid": "f4e5ff0f-fea2-45a4-aa8f-9c95fff27009", "comment": "Malware payload (AgentTesla)", "value": "883128fb8521bbf99cffbbcdf6c32d09c5a58cf8c539d387dc67fab603103a26eed6eb9f7d8876fa86b2fdf625dceec2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456266, "uuid": "8a50342b-c592-4f5b-8fc8-3963f2bf933c", "value": "8E1527802526A19DD4613BBDE13134E003B8EE27F9E54DD7429C7B22FEFB9111FA2925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456266, "uuid": "6670e1ca-2ae9-453a-852e-84dffa07f25c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456266, "uuid": "53633ec3-eb9f-47af-9ad9-17aa2dc36e03", "value": "24576:7IeadDXCrOAo8ltPHbpMANE+3RNTygDthheaB:vadDXbUj7pzNE+BH0aB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456266, "uuid": "fde5226b-5e5a-4885-ad91-6d0b0f3bf676", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456266, "uuid": "d3a0d8aa-221e-43bb-9b80-04ee85395bcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456266, "uuid": "e69d1284-1e19-4c44-9a8e-c51108292f1c", "value": "Order Inqury.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4537f45f-afa1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620439275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439275, "uuid": "010c16c6-82ac-474f-9cee-1e7d4477f1d4", "comment": "Malware payload (Dridex)", "value": "53248a832925aadc8b7d02c6bab25e5e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439275, "uuid": "530ae5f9-7edc-4e1a-961b-0869736e838b", "comment": "Malware payload (Dridex)", "value": "64eea1315f0e6930a1a3e628f7f8f9eac91ffe303984fd1b78cb018957413f51", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439275, "uuid": "52c4672a-ac8a-4e7c-9560-41814aa3cd62", "comment": "Malware payload (Dridex)", "value": "f461ee77661610128cae601d92a5a8011b7defb7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439275, "uuid": "9355d1bb-f27f-4282-9982-1a9ef5bf3f31", "comment": "Malware payload (Dridex)", "value": "c71cc2ceee61448998ecc63b0633cd3b76bc3994cf0ca5f0c3b0e3672061c5eb5c81389069489270f6bae0435e98a4a8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439275, "uuid": "d1e97a2a-4304-423d-b44d-61895c5dac67", "value": "56F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439275, "uuid": "c9057540-a8bb-4992-bb7c-7f5e672bc68a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439275, "uuid": "0f96ed47-7e24-4116-9d2a-27ca31fe1471", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620439275, "uuid": "9bc81a62-5256-4e76-9333-e7bbea8439b0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620439275, "uuid": "957f7527-1e75-43a2-9ad2-01815997f3d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439275, "uuid": "dfec6d42-050f-4757-9c3a-85f7081e4fb6", "value": "53248a83_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27565897-b02b-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620498495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620498495, "uuid": "c280d867-4eb1-49e1-8254-655fb9e7eb07", "comment": "Malware payload (ArkeiStealer)", "value": "3035f7117b6e6a33f2f05d7c1d57e94a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620498495, "uuid": "c94b8451-d4aa-45dc-8014-d35181b30a6e", "comment": "Malware payload (ArkeiStealer)", "value": "6537eb68c7eef05b0eadbcc46a7a948e96cea0ed538035ae17c2971c02e1329b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620498495, "uuid": "e5c8d4ad-70cb-4eed-86ee-d980c68e98ef", "comment": "Malware payload (ArkeiStealer)", "value": "da2097ff5927e705efef06c25f371be30b6e3326", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620498495, "uuid": "8db61eb5-49c5-44ab-b3b6-06bfb50d9c7e", "comment": "Malware payload (ArkeiStealer)", "value": "e122d3703808b886d3a67d114ea2fbd6d29ebe00045619ff639b62bb044842e8f9372e7326c7f46c6c957c2b881e19f6", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620498495, "uuid": "4fbb10e8-c095-4fc1-a3db-9ec34314e803", "value": "13E4F1113681C032CC761D764425CB79AEBBB8B65B264ECB9A892779DF307E17B30349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620498495, "uuid": "40ba969f-0fb4-409a-a095-7664dce2fb4e", "value": "21eecbc834e52df22aae59eb1273e389", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620498495, "uuid": "c79fbc1b-7e63-4c1f-82aa-46038c417f3f", "value": "12288:OePJHmwYjRRnWtkpx0Zs8WkdfVpIWz9Cpp7BVJLmUx:OePJr0Rnd30ZskfVyWKp7IU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620498495, "uuid": "ed205f5f-606c-4aec-a264-071fd1e6a532", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620498495, "uuid": "6eb9189e-d142-46c3-a9bf-0a5b5d5bc266", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620498495, "uuid": "513e4382-db19-4534-badb-046587700310", "value": "3035f7117b6e6a33f2f05d7c1d57e94a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69b6303-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435653, "uuid": "40b43d95-3e06-4d5d-9eb6-b5bc0ddfbaba", "comment": "Malware payload (Dridex)", "value": "3ac1f2fc0790e1f04d0a2eee9b2841d5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435653, "uuid": "fa715728-11b2-450b-8d06-3b0ad1f9ad9c", "comment": "Malware payload (Dridex)", "value": "6567fc23d9887e51e66d4f7fb7ef9f1c3e7574dad12fb9e25fcc0233f3902567", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435653, "uuid": "bc7e5ca1-4cdf-4204-a1ee-f5d4f68de8d1", "comment": "Malware payload (Dridex)", "value": "8d6c9a7baea189b08894657693ce63cd4b6e7fb9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435653, "uuid": "a5b902ef-2b72-4b12-995e-eab82a4c0f27", "comment": "Malware payload (Dridex)", "value": "2152fcfbcf6f84288941bc9eedc11315aa74e7645dbb591de3ba874d121492eb99dfbf612d5326b9104aad0cf4a03a1c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435653, "uuid": "20e11c56-ab99-470e-ac19-78563262e2c4", "value": "49F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435653, "uuid": "e14aaf4a-a2cd-458a-9829-e6bb19eaae6c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435653, "uuid": "4415c5ec-058e-41b9-9eaf-c162e05f6555", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435653, "uuid": "dce9427f-e628-4edc-b85f-1a06d40b8613", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435653, "uuid": "c2ded52e-4b3e-4821-b0df-64f0b788a48d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435653, "uuid": "4e8b115f-4908-4828-b9bd-bdc3493bb45e", "value": "3ac1f2fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d24353-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475253, "uuid": "e94941c5-34cf-42a4-aed0-5212184f754b", "comment": "Malware payload (Dridex)", "value": "cf003a998c99841bd1ae03bc0b24e953", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475253, "uuid": "a60fa84f-755f-4a38-8c81-248fc08189f0", "comment": "Malware payload (Dridex)", "value": "65c9a3da39b38eeaa728b00f69f89e6d4d71ea1023bfe6b3e4e750b5d6294494", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475253, "uuid": "4ce111fb-24eb-4a87-8ad8-7d3da570ea77", "comment": "Malware payload (Dridex)", "value": "9079a6f57e2ebae7b360278eb6fc6acbbfeb6b19", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475253, "uuid": "3af8fc6b-dd7d-48da-b22c-0b937f606029", "comment": "Malware payload (Dridex)", "value": "e3b16314fe1d728041e2b8d7738bb6f3cb3bbaf43d4a685fd146903f1e1ee30c8abd0ea8607bb89376c8656d8bf6e57c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475253, "uuid": "640711b0-0378-4cb0-9811-1b1ce299796a", "value": "93F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475253, "uuid": "1a1bd1b3-526d-431e-bcf4-fb7d06bc7997", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475253, "uuid": "de96ce47-c525-4e6d-b3d1-eef9065fb268", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475253, "uuid": "63148699-06a5-4e66-ac00-903d10a63756", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475253, "uuid": "61bb5b2c-ff48-40a9-a621-ec27675a196a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475253, "uuid": "55e50bb1-5ee9-4da3-8484-e59f91632991", "value": "cf003a99_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8774468e-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460861, "uuid": "b19e9880-3018-4768-b92f-6124efa0e6cb", "comment": "Malware payload (Dridex)", "value": "e055e414c8cb6218fad8236881c484b8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460861, "uuid": "4d048f27-9236-45fd-b017-d7e044dd63b9", "comment": "Malware payload (Dridex)", "value": "660330b9746987728095501c970d93f7269327e472d8296fff8dbb6af3b269b0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460861, "uuid": "8af5e692-79e7-4afe-9b09-5954c5831bb6", "comment": "Malware payload (Dridex)", "value": "c5f035ff77fb9d823e5cb7c733e3f6921412c192", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460861, "uuid": "440b3224-2e18-409a-a2d0-786555831318", "comment": "Malware payload (Dridex)", "value": "e5ed1334f1b618dc4db1baa4d0c982de4ef823e18b0dc2c14e3c89d8b6ece340a65371e9b0b9c82010392789a42e2bf9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460861, "uuid": "f6dd21e3-134b-440a-b521-1b7aa66fbbfd", "value": "A2F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460861, "uuid": "243e19df-9369-4bd4-9992-4b39d82d73e7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460861, "uuid": "f6096a49-1f70-4643-8947-41df0412d665", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460861, "uuid": "228bb314-b3e0-4e20-93db-1996502d99ae", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460861, "uuid": "b6649c12-7f29-441c-8d6e-6ab048fed3d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460861, "uuid": "e70445d6-e912-481c-b7aa-ad5ea3025c6e", "value": "e055e414_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2195c2a-afdb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464449, "uuid": "f1f6bb0b-a06a-4607-8c0b-a00528929d9e", "comment": "Malware payload (Dridex)", "value": "223dc6ac934d51f7073564399f82c885", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464449, "uuid": "f8621d67-62d9-4260-acdf-34be06c1dc05", "comment": "Malware payload (Dridex)", "value": "6614d3ef864099bcf0f0366efc589b0bf0867ba2f6583f7d2b0f80621a5f6119", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464449, "uuid": "81c6736f-15f2-432d-8a13-a14e3d66bd56", "comment": "Malware payload (Dridex)", "value": "89af214e73412ec553e310dcb66c4c080bbf4aa4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464449, "uuid": "c93ed9e5-7b5c-4943-a190-ff82789caf56", "comment": "Malware payload (Dridex)", "value": "ab0126a2c4d5b14fce9c30afd6c2098e042c0f538de1ca147dad36b1747016e223e4737b46425f46f80161ead002d0d2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464449, "uuid": "f2d798ad-f2d0-4074-9b39-103b7c276b46", "value": "7AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464449, "uuid": "488388c3-4387-487c-8b79-287a6757aba4", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464449, "uuid": "f0383e23-2d7d-4923-8ef2-ecdccbee245b", "value": "3072:4lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:4lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464449, "uuid": "7879fc0b-5092-45b0-b736-7613bd16c8b8", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464449, "uuid": "abec733f-0e02-441e-8cff-4c9c48fc8a50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464449, "uuid": "3c6fb098-cd67-402c-acf6-0cd74ca76017", "value": "223dc6ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ba5dee-b040-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620507706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507706, "uuid": "7adcdfcb-2d84-4bae-893f-63f2ba72ae4a", "comment": "Malware payload", "value": "38c8bbf6f267152d38314d28ee044815", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507706, "uuid": "b126f327-da1f-48c5-a673-08eca0768e39", "comment": "Malware payload", "value": "6633485a8bfc15533cb39f14f777300559dbacee7dc347c7eb423dd937ea4d58", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507706, "uuid": "8769aa2a-43bd-44e1-a1e3-986111afee61", "comment": "Malware payload", "value": "0a62c49d819411c561fe4a904b4a8b1902bb2589", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507706, "uuid": "76a93e18-15bf-4a62-a70d-74532a1ceda4", "comment": "Malware payload", "value": "0085f15dd2fef4e31b2690bb55c3b8ad18f6681d4ff83fbe7bb32a1a25354c6a68754bfa2f2b21dc073051886ca3d9a3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507706, "uuid": "37a5afd9-86b3-45d4-a5f2-817ba38e1254", "value": "6CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507706, "uuid": "18b42ed1-928a-485d-951f-26d8412974a1", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507706, "uuid": "e9ddcda2-a53f-448d-8ec3-c1b980df8e6a", "value": "3072:QA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:Q3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620507706, "uuid": "d761bf62-4465-4453-913f-09a7faed56b2", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620507706, "uuid": "4add987e-990a-448b-b474-12d9ab9e5482", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507706, "uuid": "5c406cd6-60b4-4508-883d-a1a42abf9b75", "value": "38c8bbf6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21363c0b-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475292, "uuid": "1e448b3c-56f6-4d3c-88c4-ed466e630899", "comment": "Malware payload (Dridex)", "value": "83e8004d929eae672ed2a81c09f225b1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475292, "uuid": "198b316e-bd7f-4167-b22c-c0869268707d", "comment": "Malware payload (Dridex)", "value": "66ca36d4133642644589cb9dc8ec8dc79a407f0a1d61585f70fbb1f12ba71721", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475292, "uuid": "42fe1848-0d10-4e6a-91d5-a1bd530c08ac", "comment": "Malware payload (Dridex)", "value": "a65ffab34c993e36338fb7d504e3d875a3dc5aa2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475292, "uuid": "f383ef96-d4aa-4dec-977f-9e711ab53882", "comment": "Malware payload (Dridex)", "value": "54b5e2a1fba36bd83a47dc969430076e42fed7277ff4eae1ec127ab327d70da63692b567bd1746cbec7cb3776d0c0e4b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475292, "uuid": "625d1a8d-4be4-4bc5-a715-829772285e85", "value": "3EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475292, "uuid": "50e8bf30-0c6e-4127-bd8f-b7f3229e6075", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475292, "uuid": "5e5af58c-f3e1-4989-ad8e-3a67397c0a52", "value": "3072:zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475292, "uuid": "5c30fb03-e5f0-41e5-b87c-5c641fdf9b51", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475292, "uuid": "68189861-69ed-412f-bc9b-e7bdda524437", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475292, "uuid": "7b5589fc-228a-4a7b-b02d-cbf8b504597e", "value": "83e8004d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e65c9c3-b034-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620502507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620502507, "uuid": "55a01c4d-0b52-44ac-892a-8e4a3dfc2a44", "comment": "Malware payload", "value": "d6ed103ce4e021dada76e7af5c11c9ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620502507, "uuid": "7142dab4-0a0c-4580-be9e-3583fcdccb80", "comment": "Malware payload", "value": "671c436f7735575fd4ac6c68b88df8ba11aaf31409a2682ab20483f48618f33f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620502507, "uuid": "334c3510-2f1d-44d0-b7af-9c1381e42aa8", "comment": "Malware payload", "value": "124cadc03fe408b868decb4de411dc050e4ebecc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620502507, "uuid": "51cf9379-45dc-4d54-91a6-4e39e7784eed", "comment": "Malware payload", "value": "b6330554d3ae730fd2758d83f5dd3ec2f99411d8d0297711344d349eb6556ad64c31e9b35993393a158b89aa7dc5842b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620502507, "uuid": "1c937d9e-d742-4d50-802e-55a2ba4c65f5", "value": "D325F1765340AF64E4BE0BBB88A6942007F6FC19D772C51E6CF8349F25B3BE151A2607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620502507, "uuid": "29c5e809-3a5c-4697-8935-c51b8501a10c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620502507, "uuid": "fe7764b9-b116-45a1-ac82-b03f32f135b7", "value": "24576:4ANv+4urDD3FxewOI9v5EvNCDVUEwwT8+:xv+4GQM9NVUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620502507, "uuid": "33c1d23a-cbfd-434e-8a08-c21b9acd5a5a", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620502507, "uuid": "c7398b64-6464-4bc4-9288-867b0a2944e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620502507, "uuid": "1566c446-f774-47d4-977e-c5e1b4bad574", "value": "REQUEST FOR PRICE QUOTE - URGENT.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55876ea2-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620475380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "12362466-f7a4-488c-a47b-17bf7d73879b", "comment": "Malware payload", "value": "d973bdb56cdf42ea94263a14fd5af9f8", "object_relation": "md5", "Tag": [ { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "623e02a2-13fa-47cd-bf0d-33ce6b4de908", "comment": "Malware payload", "value": "672523cae5914bf9ddf0d9acc78ab5c06abc6598f79d24ef586b4cfa0ad09486", "object_relation": "sha256", "Tag": [ { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "f5d556f0-cf0d-4609-955d-c7ffafe3a686", "comment": "Malware payload", "value": "5fd4df18d9ec65adc45614892d7436bca5501ef5", "object_relation": "sha1", "Tag": [ { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "6b5daa4c-339f-46a7-b8b5-291a82f306fa", "comment": "Malware payload", "value": "61097788f7d85a4b465d1b9fac33a26d366be0b1e94f6b760699ba92741e5ee3a060a2d7a5a41a8646290b528f182b92", "object_relation": "sha3-384", "Tag": [ { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "ba168cde-b34d-4a64-a921-30e61ee8b9c1", "value": "8713F27B521334B3C83562B672799FC5A422356AE94227BB15D64FBFCD6E8103160F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "1a53d407-bbdf-4867-b377-0bdbf5c1f6b6", "value": "768:9pQeAxWPr2z5+JjnYTDy1qMdCIvENKOA9wojfZx0odcbs9b:se7yCjn+Or3c9AO0hJX9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475380, "uuid": "c42d2335-5190-4a2f-a31b-427116807995", "value": 42308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475380, "uuid": "1a658270-c0b5-4d29-9bc2-59194752fb7f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "6e44e85d-1299-4e50-8019-a916de44572b", "value": "oFRAN.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d441b5-afca-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1620457132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457132, "uuid": "05648d61-3b83-4995-a8c5-f996735d7c13", "comment": "Malware payload (RaccoonStealer)", "value": "9c1fc593fb35734de8741a3dd9cd9089", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457132, "uuid": "ee574b61-bedf-48d3-95bf-c321927ea1e0", "comment": "Malware payload (RaccoonStealer)", "value": "6751f6f222501da88e6c56d558b2032906130558fc993e184ff173850f2b6154", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457132, "uuid": "4c1c7a4e-e1aa-43a8-97f7-b539e18ca9bb", "comment": "Malware payload (RaccoonStealer)", "value": "35ec6734d59210aa8f11ce1b3713bf96e66f5941", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457132, "uuid": "f73198a1-e4bc-4df2-89d3-900d8e5a323b", "comment": "Malware payload (RaccoonStealer)", "value": "623ba2e7006aca4536fdb0cbbd716bdc264e3810b76cd77de1732b85ce4c5a86e1c335aa7fd5c0a65052a3245e463ea5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457132, "uuid": "0d86d8e9-b26e-4f17-ab5c-b53bcda1ea12", "value": "6015F220F653C436E5F715F449B682AC69297EA05B2420CF13D62BEA47346E1BC31EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457132, "uuid": "44e8abc0-9c50-4087-b5b7-2ae844b57c08", "value": "5f1a8fb17e535ee15ba0bcd80f9090af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457132, "uuid": "f431e902-12a3-4b3b-acc5-cf573abb51d0", "value": "12288:teBQsCN6Ljm93U+Su83CJkXayu8pyk+shOiUSCnwqFY+nluvi7GWoDsh:QysLSOu833Xayu8r+zwl+nUaOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457132, "uuid": "6991d170-e8c7-41cb-a86d-b637d20260ef", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457132, "uuid": "e54cea86-8b3c-4a0c-9da2-c205270a32e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457132, "uuid": "661ab25b-dea7-4a9c-842f-87adf429ca38", "value": "9c1fc593fb35734de8741a3dd9cd9089.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e88dfe-b005-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482496, "uuid": "64892db9-2be6-4f1d-864a-36ecc6eebc53", "comment": "Malware payload (Dridex)", "value": "7dc958f20bca93c7b0ae378b02670903", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482496, "uuid": "89a96795-3950-44cc-82d6-1d0f423d6767", "comment": "Malware payload (Dridex)", "value": "67644630ce4e5695255c91146520d5cf79890d664cde4697c55a4292199dc9d8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482496, "uuid": "8775d0c9-6450-4a3a-a086-d6e172b635b9", "comment": "Malware payload (Dridex)", "value": "3cdd50dfde41210481d6a2e0c65ea114fe8cc587", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482496, "uuid": "6407f6f4-829e-41d6-a006-6030dca3453d", "comment": "Malware payload (Dridex)", "value": "ede06966b154f4af70d0bd7caedfb8745ab3b1def02e0e8b8b09b5ff9b09ade41b9c1608a087f52c6aaa1cfb44288128", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482496, "uuid": "b23f3c55-227e-4f06-8df9-362323027e2a", "value": "83F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482496, "uuid": "87250a2e-a74e-4062-a535-a4b96f400a33", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482496, "uuid": "62659e4f-7792-4fe9-b597-ba31db635956", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482496, "uuid": "248d44a3-bda2-4e90-b6ea-0b1338975910", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482496, "uuid": "efb47cda-3882-47e9-be93-851ef42cda9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482496, "uuid": "e9365c95-2f74-4077-ac5d-46803671d7d6", "value": "7dc958f2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f82347-afba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620450072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450072, "uuid": "afc837ea-fa07-431d-a25d-f6a868bb8f06", "comment": "Malware payload (Dridex)", "value": "6b399e4e60eaf8c78d1741f0fb1c664b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450072, "uuid": "7b5c58de-6e88-4ab2-a503-c2b17aabadbd", "comment": "Malware payload (Dridex)", "value": "685a098b4891d574262b0788e835b68beaea75e62d87e55d1297f271081f03c1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450072, "uuid": "f3353a86-b37b-4d38-b5ad-e9eace4a09ed", "comment": "Malware payload (Dridex)", "value": "c344fb138b0e209c6fd66e7be12321ffbe8c9970", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450072, "uuid": "761bc7a7-1f84-45d4-8172-d5c7defb2d91", "comment": "Malware payload (Dridex)", "value": "78e8efc215ee27559e9a213df172424c84067bff03474300ba1d3f0c895ab914c568a583e34bd49702a9d1555c74ddd2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450072, "uuid": "a9ffee98-a5f5-4f5c-b3ca-0c0fd169f498", "value": "32F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450072, "uuid": "cb1af858-471f-41f1-931d-9421e058de62", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450072, "uuid": "6ae914f6-84e2-41ea-9d3c-c4754e782da5", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620450072, "uuid": "1d6b37fb-3a26-4c03-a736-2fc0e43be8b5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620450072, "uuid": "5c4dd699-b2a5-4564-a1d1-b0211fbf970d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450072, "uuid": "6f8275fe-18f5-4be0-b4c8-5a5892e2aa05", "value": "6b399e4e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538884de-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475376, "uuid": "fef50cc8-6584-46d9-853a-b3fc46bd36c8", "comment": "Malware payload (Mirai)", "value": "67c43d4b76a4d1cbaac6a56072f9b331", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475376, "uuid": "396bedcd-2fab-4481-a56c-34d423f8e708", "comment": "Malware payload (Mirai)", "value": "6898796a26f63b6e522403106ff646b7e69dcff3be8e50b3dc0b12b8aba2fad2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475376, "uuid": "f84ceddd-71c2-4ac0-a6d6-04951a161fc5", "comment": "Malware payload (Mirai)", "value": "f4cc6e1655b7d2dbc0b9bdaabd3274eced0d2e39", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475376, "uuid": "410434a6-7a8f-4b0f-b2d7-a2e5da558851", "comment": "Malware payload (Mirai)", "value": "f42249904bef8f4a53a38f217eecb30f2d2b2f86605d15eea6dbd8f2c639e964fe7a795ed215ed49ee4b32e1804ecda1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475376, "uuid": "db212ae5-1473-4a6d-b46c-bb894323c82a", "value": "8B93741AAFA05EF7E8AFDC3346A91B4524CE5416258CBF75BD30D918F20A24F15E38B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475376, "uuid": "4f28de6a-9101-4f43-9406-738e9539ad7a", "value": "1536:GRWuNskH9ZBLPt57Rop6/33G6Cx5E8FjBwFudSZCLHS+:iWuNskH9fPtRap64rS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475376, "uuid": "d4adf450-afea-4830-aabc-05dac232f45d", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475376, "uuid": "de568509-bcdb-4134-aa6e-ecd76a811094", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475376, "uuid": "1150d766-7f61-4fdf-bb50-86f2e8269719", "value": "KKveTTgaAAsecNNaaaa.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018d3d6c-afdc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464501, "uuid": "33b3c08f-433e-4b81-8928-53608bdcc0f6", "comment": "Malware payload (Dridex)", "value": "d0ff4392f7e49641d39e8a3a4beb3a9d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464501, "uuid": "91377a4f-895d-4e54-940c-23a12cae3329", "comment": "Malware payload (Dridex)", "value": "68998e6d018747624cc7858a692a1251a7b640ef840997e66b2441ec2bdbcd2a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464501, "uuid": "3d8432f3-e8bd-4a93-ad7b-a0cf0aed22db", "comment": "Malware payload (Dridex)", "value": "8be13aa6153de91a38aa2d808a12224122f61881", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464501, "uuid": "888457d3-c5d5-46f8-a1db-bb78be9d8d12", "comment": "Malware payload (Dridex)", "value": "8b3ef3c3ee421941dfcb586cc7e28f00d7f209523dd094c91311e8840e4a89e251dbbc9b34ed78be242dfbc12d9a61bb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464501, "uuid": "446ee42d-f589-490d-93bf-835d0b6c99a5", "value": "CAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464501, "uuid": "b77f5ada-2f18-449e-9e9e-e637591c5465", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464501, "uuid": "55514d30-d3e1-44b4-b5be-c09a9038c96b", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464501, "uuid": "cdee5c1b-ff9e-4cd8-8cd8-0ccff6e71310", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464501, "uuid": "087a14c1-e6f7-4bfe-8da2-2639db505000", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464501, "uuid": "19753a0c-eba9-4d28-9947-14927d2057c8", "value": "d0ff4392_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de7d137-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442833, "uuid": "3ee6218c-d7b1-423c-a9f1-e5ae27b861fc", "comment": "Malware payload (Dridex)", "value": "420254579e1e9a588370e8454198f474", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442833, "uuid": "64ba8977-35b1-40d3-82c2-d6f0265d8758", "comment": "Malware payload (Dridex)", "value": "68ef6aac3b54d608eaba757c3495ac4ef144415022e0bf8289a85b0bdc33208d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442833, "uuid": "529d9092-6d66-42ca-8326-37da4c71e9be", "comment": "Malware payload (Dridex)", "value": "497dde3020142361a518c02243431c7acda973f4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442833, "uuid": "d07a1730-9c77-42be-a5c5-289991e8e4ed", "comment": "Malware payload (Dridex)", "value": "284c9a4b708cd27823f3ebd1415641132e387ee51172d5c9bda7b6c635bf7ed2aa4e3033aa0311f88b01e2a01a9a917c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442833, "uuid": "83202219-46cc-4e9f-bed7-d11562f69def", "value": "ABF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442833, "uuid": "e5a2d8a6-15ff-4f29-a407-f4ba45bbd05e", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442833, "uuid": "7bc81d96-83b1-4690-9c75-fb9b1a87e068", "value": "3072:KiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:JeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442833, "uuid": "2a46ec42-73c8-42a4-8222-54fe7897bff9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442833, "uuid": "4d39e7b7-dc10-4283-8452-9b452125e306", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442833, "uuid": "38d70567-17b4-4750-8ef6-717d1234cdce", "value": "42025457_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8bf7e0-afa1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620439258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439258, "uuid": "61e49b88-94a6-46a8-8093-ad00429ff7ee", "comment": "Malware payload (Dridex)", "value": "acbb39fc83f787f0b184902d60c5b800", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439258, "uuid": "ffa915d7-2f21-48b3-9682-d1ed5df66d28", "comment": "Malware payload (Dridex)", "value": "6902b0079de33dcb7d3395ff2fc2879d1439a108bc21f141c97a61972fb717ef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439258, "uuid": "ef123ab8-471e-484b-b3bb-78945494a637", "comment": "Malware payload (Dridex)", "value": "d8b86a0b1e011e0fcc2e72597b469a188f02a00b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439258, "uuid": "dc604d48-7b96-48b3-967e-9be88ecad652", "comment": "Malware payload (Dridex)", "value": "3177389e04de52c05cecf3f4946d38b6a4bb0b80c9406d6ed8a9aa49b1297ce8b371152c1b5b8e4d1aace87e2688d073", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439258, "uuid": "d7d59914-5752-47f9-a450-155e05f45af7", "value": "35F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439258, "uuid": "061210ae-ef42-483d-acea-b0d53af3f1f6", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439258, "uuid": "30689752-ca34-44c6-8a4c-eb962398cd91", "value": "3072:tWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:t42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620439258, "uuid": "e4fc9100-e78d-4321-b105-2775f44339e0", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620439258, "uuid": "88724aaf-1a8a-4f84-a136-62e8067603bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439258, "uuid": "f80fba5a-30c0-4daf-a582-460127701dec", "value": "acbb39fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52255f92-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "68b51fe4-c287-463c-baa1-621c311775d1", "comment": "Malware payload (Mirai)", "value": "f76428dda7657f492b3fdf27de39a93f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "0b681464-cb49-4196-94a2-c75aed0750ae", "comment": "Malware payload (Mirai)", "value": "6920a902ff80858a8fdcbe59e7943bb45439a5df0b4a152bc4792ca75e6ddbaf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "4644b5d4-7a4a-4a85-94ce-df403dbb15cf", "comment": "Malware payload (Mirai)", "value": "dae6df7d7aaf88199819842a8df6007ac184c793", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "3f92218e-662a-4fbb-ab4e-05b300ebefeb", "comment": "Malware payload (Mirai)", "value": "e53dca31f51bcd7b3ba395b27be86567b28182652dc24f3afd7359ee31b8a784bfc9aa66fd7711ec9fc0439144bb95b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475374, "uuid": "e8a05be1-b018-441e-8a56-9f939c9f0d6e", "value": "04735C34A97E2F26C0C4A17E52F78750B2E5220F2AB4965D7CB20F4FFF24544A8562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475374, "uuid": "c61e15a7-7520-4834-a689-1eaac5c888b1", "value": "1536:vsnCSemCLLWeKNJ+1kbOSYcpC636v/bcYSZUFFi:rS1+SYccv/gpmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475374, "uuid": "36fc19c1-11cd-4fcf-a7b9-49a03aad790d", "value": 75388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475374, "uuid": "bf967bbf-c793-44eb-a228-9eb65308f042", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475374, "uuid": "094fe4b0-db03-47b3-944d-1e6a15bb51f8", "value": "loligang.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a72cafa-b030-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620500594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620500594, "uuid": "8e2f267e-fc2a-46a0-95c0-673697c5f363", "comment": "Malware payload", "value": "6580f276ce08a4b663c5d5ed7ddfc523", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620500594, "uuid": "ccd5133e-a3d9-49ca-a976-cdd28a5f8dfe", "comment": "Malware payload", "value": "69afe0c0aa73e4e4c3f79acdf6f0d9513bbafc26a5373b9283129473cd3e8eed", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620500594, "uuid": "1d90a46e-2769-42ca-b361-1980b5063679", "comment": "Malware payload", "value": "c3014858f7d2c24d8114a22c66dc022f6d7f9bba", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620500594, "uuid": "44bdd3f3-4625-4fc3-b03c-48a845c5003c", "comment": "Malware payload", "value": "f7df3a5787c8f08a40c5858a4773246870c01834a2963fd7b99771a644bfcce0f37b16ab7c93e0fa654e8720f9c1da8c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620500594, "uuid": "22504c98-38c6-4b95-84e9-0e911ec32568", "value": "13F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620500594, "uuid": "dc5c21da-b6e6-4e74-a4b6-1123e0590b12", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620500594, "uuid": "5947f99a-0c18-4ec9-8950-3f4ae512b576", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620500594, "uuid": "8934b416-c838-4794-94ba-988d5de7cc67", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620500594, "uuid": "f75ce767-9064-4726-b008-bc3a5d24d45c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620500594, "uuid": "d58332f3-c569-49c3-ae2b-e9a379fd65c3", "value": "6580f276_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e57d03-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457315, "uuid": "32d27209-ea48-4dc1-9a0f-c9bcc89e4654", "comment": "Malware payload (Dridex)", "value": "889f61c611e9d53bcbcf2e7eade2abcb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457315, "uuid": "9e78d242-8620-4b93-8398-dcd82676f05a", "comment": "Malware payload (Dridex)", "value": "69bd05280f52d5b4c1bc0346b79ce70f25e6f747ee4bfb1d5ffdc0559d847965", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457315, "uuid": "c04ee2e7-cb15-4c7d-8bc4-e6d81c3f566b", "comment": "Malware payload (Dridex)", "value": "3ed265e0d2e38af8d2b63a0dc2e8df135c131295", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457315, "uuid": "d0d9ec19-0598-4095-91b5-7f1d505e76c1", "comment": "Malware payload (Dridex)", "value": "fff1c58233c27bd9c1eef9c6634cd6596da10f94d4a18706c62b4713d07103c068b38c195074d7f5448de7b923cdaf34", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457315, "uuid": "fb6b5e49-7c16-46c8-81ed-c754884226c3", "value": "76F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457315, "uuid": "cd1da21c-ac9c-482c-a5d8-50ec99697bf1", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457315, "uuid": "832bcdd0-13d5-494a-9826-97c5123ad06f", "value": "3072:AWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:A42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457315, "uuid": "fcf8876e-7a61-41ba-8c64-340da5d32cbb", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457315, "uuid": "e1624d57-0e9a-4a24-9806-3c098abbc115", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457315, "uuid": "5d71f1f1-945a-4e90-b61d-b22c0df028fb", "value": "889f61c6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d6f971-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432061, "uuid": "0f38b93a-af62-4c89-9600-f6018cdc30f9", "comment": "Malware payload (Dridex)", "value": "cfc96c849823b1dbe81c1aa090dba882", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432061, "uuid": "c962292d-1411-4771-a2ac-73772b849f1e", "comment": "Malware payload (Dridex)", "value": "6a2a42314aa35a49a1d03a9bcc92320a6149c4fb99bbe9ec139770c5fc891a75", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432061, "uuid": "c0e3c3cf-2dd9-400b-a83f-ca094f7e31c9", "comment": "Malware payload (Dridex)", "value": "1a8e141b378eaad7107ff51a1695fdc14868c1d4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432061, "uuid": "48890150-4809-4ac2-afa1-c3fe84022a8e", "comment": "Malware payload (Dridex)", "value": "b427dbfcc022186a5d714e2c56cd8dab391b76d34cf392da6afff9ee3094e7acd3530b585f5d1161c052eeb06e8dfc1e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432061, "uuid": "65800b1f-9af6-4bbb-b4ed-e06b0089a2a3", "value": "16F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432061, "uuid": "22a7d785-be8a-452b-bcbf-1e45074598e6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432061, "uuid": "d025fa69-dace-4f08-bebb-02dd2a3a2043", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432061, "uuid": "6936775c-269a-4509-bde4-1c9282db0dff", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432061, "uuid": "f945b45e-2926-4f4a-987b-a6168e705adc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432061, "uuid": "8c6cced6-692b-444b-8158-9a98b75e59b7", "value": "cfc96c84_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfec5b78-afca-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1620457143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457143, "uuid": "489b0009-765c-445b-9654-50c8ee7870aa", "comment": "Malware payload (RaccoonStealer)", "value": "8d02d5652db095c0af6beb5b58d756e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457143, "uuid": "04d2184a-d555-4831-a9fa-c7df19b4ba79", "comment": "Malware payload (RaccoonStealer)", "value": "6a67b3b72238ab1e9ede09686b226413829c7a48a858845f09e8abd0dd094823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457143, "uuid": "34ec52c3-419f-4d21-8d7d-a24466d96343", "comment": "Malware payload (RaccoonStealer)", "value": "0f3612ec869a19df843dd343d11074b635b2cd0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457143, "uuid": "8aebb8a7-1cf0-4d14-94cc-97b6d167a87f", "comment": "Malware payload (RaccoonStealer)", "value": "0042b1c9ff0736ac2ecd7a6865510af238a9cce2b0badc624c31bcbfbec23cce4c7ad515264d328808171ef97bbf1f80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457143, "uuid": "d5fbaf9f-5e55-4c33-bb67-2f590a228141", "value": "AB05F130BA90C034F9B711F889BAD77C753D7EA1672550CB12D42AEE92247E4BD3129B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457143, "uuid": "352643ca-464e-4ca6-84c4-ac0d9ae847ae", "value": "39a74b7b85025eb79aaa0ef9cd5243a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457143, "uuid": "55e305f1-5858-45b5-aa30-d422b3c7fe2a", "value": "12288:bEFbHC/zufuXG29xXnuCfMwPYn5Qiv/ROKiJ5oV+JojzyEDDyZi5VW7qYXrE:qi/KYumXPTi3xiroV+uKJ71Xr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457143, "uuid": "67e25df1-450d-4842-8517-beab14bc8268", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457143, "uuid": "9de9d32a-eb5d-4176-a198-cc02c7ea28dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457143, "uuid": "a1f456a0-96e7-49e5-92be-3a9245637f2e", "value": "8d02d5652db095c0af6beb5b58d756e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c5cfa0-b040-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620507852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507852, "uuid": "08e662d2-bf7a-456f-bcfe-ae5e7b7df00a", "comment": "Malware payload", "value": "116f4442795d28cfa522ceddf71a15b6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507852, "uuid": "70b7cc9c-9645-4419-873d-41f994085736", "comment": "Malware payload", "value": "6addf73e3401962adf170a09cb5672330c218abb43a4fb436ab6e53c1503537e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507852, "uuid": "180057ca-8a5e-4fad-a0ea-50f4c48c7b51", "comment": "Malware payload", "value": "476f4d847d2db88710037923fb6d0e7bedf03c01", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507852, "uuid": "52d9723b-aa46-4e01-a415-81ff62a367f6", "comment": "Malware payload", "value": "7590b40699522b703a073d845026526e1a9e1524410a311877d6ec9aff76abdcc79177afd6226adf18d68a2d6314b76b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507852, "uuid": "33a32a9a-997c-4d0c-87af-f8a5a0ff0846", "value": "C7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507852, "uuid": "85b2e4cc-d1ac-4de5-857f-95ff77685fff", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507852, "uuid": "3b67d49e-699b-4073-bbc2-6b1c00ea6723", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620507852, "uuid": "dc316a99-6d9c-41ea-9942-680ca56dbb97", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620507852, "uuid": "a17e3c2b-f6fc-4e60-aa58-b53c622f7b71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507852, "uuid": "a09ea29a-a9bb-4178-b3f2-a05ab7c73e16", "value": "116f4442_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f630f61-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460901, "uuid": "b90549ba-c81e-41b2-a134-fa49a31e8833", "comment": "Malware payload (Dridex)", "value": "3b00b8fcde333e9456f0a1b84f9ffcf4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460901, "uuid": "6f5dc9cb-8e44-4334-96a9-0323a7997244", "comment": "Malware payload (Dridex)", "value": "6b03c2bc0cdaf29eaafcb3d5e9548dab3f502c4a259b0ede7b131e7288c4a755", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460901, "uuid": "05d1057a-c854-4f96-aac6-c84e5fa26300", "comment": "Malware payload (Dridex)", "value": "62b41fd4d40a8180094e8e8ec81285b4f44a789e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460901, "uuid": "f77b999f-3290-41f9-a769-945f398b2ff3", "comment": "Malware payload (Dridex)", "value": "622273f64b26f5a78042aed716d18a4ab74ff62f257712510aa6392d83dc5122064ce5f6d649b0647660b9db7522478d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460901, "uuid": "ae2f6435-531a-4144-8b67-b195ea1720b8", "value": "82F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460901, "uuid": "5ee8d846-e923-4f3e-ac73-ab2ce9975e0c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460901, "uuid": "86766a30-f43a-40cd-9b83-78937c04e733", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460901, "uuid": "94da9560-de2d-48d3-95a8-04f20f83075d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460901, "uuid": "1e0f5f9f-b3da-464f-b23c-d5fde0f3662a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460901, "uuid": "45d2f0ea-6732-4e7b-9316-20a468fc273b", "value": "3b00b8fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521a664d-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620475374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "af9dcb3d-879a-4aca-829c-d96774625976", "comment": "Malware payload", "value": "95717f4af33ecaf6d756cbb07d97cb05", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "f83a4554-6937-4a13-93f8-7132b15f3a15", "comment": "Malware payload", "value": "6b1fece6da56033b72703365c236801739c8b9dd35f9898ba8c55f6cf912a7ce", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "7ae025ff-084f-4a43-8cf7-a4e863e8d458", "comment": "Malware payload", "value": "7cc3d87bb892259655868cdd8100c216cb950970", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "9435f3cf-cba1-450a-b65f-767374d84240", "comment": "Malware payload", "value": "683ac233024ff5043000a293dbf76d0e3e69b736874b2e7d575dc551d8b5605065dcd52ca37ea4c6ac257b2c34822189", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475374, "uuid": "dad06c2a-b2f0-403c-9eff-20b69932535a", "value": "61A33A92F808EFBAF40E963B84634502763273F39AD45B71A2536877DC761C11D6BE82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475374, "uuid": "57a51bba-358d-484f-8cdd-3aa21001e7ba", "value": "1536:WuuHyTlHbRaRhPm1g8ONeoaXA8m6QPT+l0MdgflYyyojsTy9:CylHbRaXm1SenAR/EyflYyyojsTy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475374, "uuid": "b8e087d6-d2c2-45b4-be63-cd9f8290dc56", "value": 98404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475374, "uuid": "fc4249c6-4768-486e-a7cb-b7a478fe5687", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475374, "uuid": "5c7bc425-9f84-491e-aa07-133913ce2cb0", "value": "m68k(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0d82f9-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486074, "uuid": "1a619b2e-595e-4424-a3d6-ac4dbf2ebad9", "comment": "Malware payload (Dridex)", "value": "f063860b4d51e18496a1132761592135", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486074, "uuid": "f190d200-a1bc-4e18-a9f0-948932fbf059", "comment": "Malware payload (Dridex)", "value": "6b642fd31cc4bf60b9305b00b4de3e540cbe0f856395b7ed9c1c9250ff92d2ec", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486074, "uuid": "51949515-7a13-4c13-871b-c8312279184d", "comment": "Malware payload (Dridex)", "value": "1b5db017c3b0871159b4b30e448c02472f7c39d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486074, "uuid": "11d8fb8e-df06-46ae-af66-d2b9fb42c2e5", "comment": "Malware payload (Dridex)", "value": "fe57ef853376c44fe7f5b78490a254fb482ab10f5fe7434f2acfd79835f185787e2d6e50005e10f301fed35fba316191", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486074, "uuid": "e7b3e343-d05d-4c05-9a1c-fdcebd23c1b5", "value": "A5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486074, "uuid": "f0185d4f-fba5-416e-bb7b-ca4941620ea3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486074, "uuid": "aa9fbab2-193f-4557-ae72-8e8359f81086", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486074, "uuid": "90f19f41-61b2-40f1-ba54-52f07ba5aadb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486074, "uuid": "1316449f-b057-4594-a135-21e9ef2129b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486074, "uuid": "66299ed4-9d37-4268-b668-9a4dd2d1742d", "value": "f063860b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ee0bde-afdc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464537, "uuid": "7bdc208d-cd28-4e79-98af-13382f72c678", "comment": "Malware payload (Dridex)", "value": "d36de543aca6f6dc86b181a1e4998771", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464537, "uuid": "c499eb30-bf31-44dc-85b3-742a7857b5a9", "comment": "Malware payload (Dridex)", "value": "6c0d69a7a648d5a3b90bd0170d7bfea0897ab1098e53d2a6dd73d034a040d606", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464537, "uuid": "ae652273-21eb-4dcd-9aa1-5eb5c13e602a", "comment": "Malware payload (Dridex)", "value": "fdbfaddeed77ada30ff242b776e8643c8c5d29cd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464537, "uuid": "41f1a30a-d84e-4d74-8b0e-d0af0a757ffc", "comment": "Malware payload (Dridex)", "value": "5e3aee4ef76ea82fec7fffb534651e66bdf967b7e2f1fcbe9e2bac5b10f7e926ddc1764361573e12c69432512f78b841", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464537, "uuid": "571a2c43-3a76-4afd-b70b-1058c83f13e0", "value": "41F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464537, "uuid": "107e7d96-3395-4998-b4c2-c5909a08192a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464537, "uuid": "503b3dc1-9bcb-48e0-bb35-5474c5129c4c", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464537, "uuid": "2d27d974-f3cc-4532-a678-03b922d7b6a0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464537, "uuid": "4d57fbc5-0c7b-4aa8-8889-620113c67dc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464537, "uuid": "d8356172-6fae-456c-80c5-20b08eb09a39", "value": "d36de543_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a558564a-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489687, "uuid": "7590dff2-a8fa-4610-afc9-74b9022d1aa3", "comment": "Malware payload (Dridex)", "value": "0872edd0e01363ebbc152403b393a456", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489687, "uuid": "92e51d9b-c759-481d-86a5-f5bd4a519920", "comment": "Malware payload (Dridex)", "value": "6d22f2c61d2b6793354f443914bcd0005469eee0fc754cdef369f17761c225ed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489687, "uuid": "02a1eac9-abf4-4bd5-b99f-5c45d4516c6f", "comment": "Malware payload (Dridex)", "value": "cecd926bc7ec42a0aec27a429507b7a47c668471", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489687, "uuid": "d8b3a533-7522-446c-bcca-3b43d12e3a2e", "comment": "Malware payload (Dridex)", "value": "1859b1450d87beecf4e2556f3634033da60e84e1db77b45440b9a9d6db6d69cfad84d19ef19112f62057f1ae430bc30f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489687, "uuid": "786036b2-6a52-488c-a67b-8c0a6651f4c9", "value": "1AF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489687, "uuid": "2442ef74-2fce-4f47-9522-37bbf598e1f4", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489687, "uuid": "cdb184b1-3ca3-4bf5-9d88-be1b572369b0", "value": "3072:nWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:n42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489687, "uuid": "b59ced2f-9e63-44e0-b168-62688eb93bbb", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489687, "uuid": "28a5c373-a75e-4915-9135-a9ee3ca0e1b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489687, "uuid": "800fd667-3a7c-4161-b2c8-0c60381feec6", "value": "0872edd0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569b822b-afba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620450041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450041, "uuid": "615a1e40-1bf6-4d94-a8bb-35bd0ae6d2fb", "comment": "Malware payload (Dridex)", "value": "fc67ecde3686c743126192091eff8044", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450041, "uuid": "3071fb6c-a707-4d51-b7ba-af4069a53031", "comment": "Malware payload (Dridex)", "value": "6e913357aaa5cb374bfc4e2e6830726d513cc5d7a45c17bacb96497b177e155c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450041, "uuid": "5d709375-550d-48d7-b92a-a238e2a0c91c", "comment": "Malware payload (Dridex)", "value": "b16b86f793444b2eb0cb29e79c5fc990dfa5353b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450041, "uuid": "dfb32193-8ad5-454d-8a4f-27512bfe9444", "comment": "Malware payload (Dridex)", "value": "13998985218c692b5cd2fef77e2914e2a9900e0836059bbe786a5e07a224a45d9b8f645e00e81be57cfb18108505f87e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450041, "uuid": "d4b31131-8071-4a80-b7f2-5ecf03573151", "value": "55F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450041, "uuid": "99984e0b-6cb1-4d67-9556-17cc26fac9fb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450041, "uuid": "15e70704-0c9e-47d1-bda4-e204d9044f06", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620450041, "uuid": "d74ec30f-531b-4220-ac82-47e257406d6f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620450041, "uuid": "cf9432bd-a949-438f-ba3c-3c3446b281a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450041, "uuid": "70acf8e6-328e-4f5f-bec2-425c6b4a5484", "value": "fc67ecde_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573add8d-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468081, "uuid": "df406a76-86cc-4575-b322-6c52fb8b1cb2", "comment": "Malware payload (Dridex)", "value": "f3554af96743fff9f0cdd82d2e45cdfd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468081, "uuid": "3d6373e7-17b4-4979-8561-c7c425663857", "comment": "Malware payload (Dridex)", "value": "6fe8f2da85896657ec16445ebce3add1a189bb6f650b0c9faee3ad2ddf4072b5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468081, "uuid": "74563c77-d178-407c-8d86-cfffdb61d1c2", "comment": "Malware payload (Dridex)", "value": "fc8fe2b22388c303c528924ca5c4bb4a41b77194", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468081, "uuid": "9f681c56-d890-4351-88c5-f54cabc84587", "comment": "Malware payload (Dridex)", "value": "e0acd46e87f9d391caaacc2192e1cfaaa23b11f36887cd87100effb40f2d4884277cbc6a0995c89986a61b982fa68668", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468081, "uuid": "25468f09-6d0e-4ae7-a8d9-a39fdac0c32c", "value": "81F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468081, "uuid": "3b1b31f8-8aa7-4ac5-8a3d-d4ff81d7742f", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468081, "uuid": "03a164f3-4f66-425e-8620-21fa7198c8c4", "value": "3072:xiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:CeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468081, "uuid": "ab8d59f6-d8e6-4936-b8bc-9fd69c689534", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468081, "uuid": "9653382e-35b9-4b45-af98-4ea220af3e1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468081, "uuid": "106c3fbc-3705-4fab-97b7-c72f99529402", "value": "f3554af9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e567f8db-b043-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1620509122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620509122, "uuid": "d1643286-e2b4-4e0b-851e-764ecbfcb761", "comment": "Malware payload (RaccoonStealer)", "value": "23fed1c9856f4e0565d76ba346197dbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620509122, "uuid": "5e895154-049c-4b56-8fa1-35ca38da3ac8", "comment": "Malware payload (RaccoonStealer)", "value": "7052ad910ee7b7f7b15c86e59fc9b09d83b6501bf929b737a2c0b8b1d7d04d5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620509122, "uuid": "d5ba3acc-eb8f-4e38-ba69-1895848629eb", "comment": "Malware payload (RaccoonStealer)", "value": "ba795084b2b4b46b9f66fddc1fd908cc87fd852b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620509122, "uuid": "a9717fc7-764c-4f5d-94f2-b277d6b7c5cd", "comment": "Malware payload (RaccoonStealer)", "value": "d6fb7573b0cd3f5642c2a869b5d1c70438493c51649343960c427e03815eebfb189ecc94fd1b0f392ecf917184b9d188", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620509122, "uuid": "b43fb71c-01dc-4b1d-af72-fe033bfae2c0", "value": "4FC4CF10EFB1D034F5B26AF44A7992D8693A7E726B3488CF12C212DA5A346F49C71377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620509122, "uuid": "a52b77f6-aba2-4615-a889-a430a38e6739", "value": "48e796cf546b09988f5fd57d931d6e76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620509122, "uuid": "c5149bf0-edc4-480e-9bfc-120efe4c5486", "value": "12288:LzvE1UPQNHSqUORyI2hY7GSAmkdckNBpuIn2S:LbFINHSORpaYiIackNB4g2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620509122, "uuid": "ab02dbbe-066a-4cad-a966-3b515029b288", "value": 555008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620509122, "uuid": "b00ca60f-beff-480a-a52e-dbd95731fbf6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620509122, "uuid": "775187ee-9618-414b-a116-ad1b93ac8874", "value": "7052ad910ee7b7f7b15c86e59fc9b09d83b6501bf929b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feab68fd-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Amadey)", "timestamp": 1620479099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479099, "uuid": "53946a17-1c62-44ac-a7b0-e19a93208f48", "comment": "Malware payload (Amadey)", "value": "95cf3fb1bee9a2cf50d999142e6b6b4c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479099, "uuid": "6f567cac-06aa-4846-8bd9-c2bac88efc89", "comment": "Malware payload (Amadey)", "value": "706ace133ec546df3aebe4ca0ca927ee1f3059e570cea2e8f6e98e77882f8745", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479099, "uuid": "9bb4d50a-78b2-4698-bfb8-a839c8271639", "comment": "Malware payload (Amadey)", "value": "23b6008f9b89517d3fe81466a5d1c9beb8b1d5fa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479099, "uuid": "3a5e8516-bbde-49f3-9874-8afab754cd5f", "comment": "Malware payload (Amadey)", "value": "af94855ffd99108eb36460319737e967855f6291f0ef34fe8c2f2952197a35e9f072c5c786c29b33f4e19279a5d3701a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479099, "uuid": "4a7b95fe-ad22-4076-adec-a702783cf4c7", "value": "CFC35A73F1D18872D0780E7CDC5A92986A6FFE212D25165BB6E50E0DAD392C27C2C6C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479099, "uuid": "2cc9ab86-e389-45b0-ba7e-a546dbea2fcd", "value": "a02ab1a937fc1433a9abad7bc2badee6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479099, "uuid": "47fd2a7b-b59d-4747-8933-1bea3debde4a", "value": "3072:WeZmogDk+FTMLObNlEB+VSdQgXHOPz2XPLekW9:WeZkgGThNlIWzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620479099, "uuid": "a7e790cf-ba37-4854-b980-d7bcb37c0e1c", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620479099, "uuid": "46821506-3a43-47e8-8de2-6344051330c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479099, "uuid": "94d37750-12f8-4bab-ae88-0a9e5d1fccfe", "value": "cred(1).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047da9de-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475244, "uuid": "01dcfea9-8c43-4b0d-ade2-11719c448a74", "comment": "Malware payload (Dridex)", "value": "077780b8419db99550697a30f87b9e3c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475244, "uuid": "c76896ab-cf26-4f48-80ef-9c3ece7c9fd4", "comment": "Malware payload (Dridex)", "value": "70a0f5a659e8873f63b7ea9c9a30ee816d3ae9b3175c8dfe860ccdbc0b3e81c4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475244, "uuid": "b00a35db-7179-4145-b19b-c58ac5df972a", "comment": "Malware payload (Dridex)", "value": "b439c0565a8e22e2b01ca0c42f25f70628e82800", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475244, "uuid": "0d49eb5b-fbc5-4163-a5c3-c87ccc44cfe0", "comment": "Malware payload (Dridex)", "value": "1283dbed62a57d89eed739b53d68b3d5a13f56778c8c970213f354d7b4f8ba0200556e91be2f69abf408a72b55792ec1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475244, "uuid": "f8f5cee1-5dc9-4bac-a5a0-747f088c9ca2", "value": "4BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475244, "uuid": "51fac578-1e9a-4352-9c54-411e42987d12", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475244, "uuid": "5bc1f4ce-e360-4ca2-bc7d-d41db1acaf84", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475244, "uuid": "2144a402-89e8-4492-a5d0-7809e5a2ebe4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475244, "uuid": "de95ddf0-0433-4d72-807d-fc10ac98fda5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475244, "uuid": "298ed4cf-abdd-44d0-89c5-b2cc6e39b79f", "value": "077780b8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e16c9c-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442879, "uuid": "de042bb6-2062-41e8-8cd1-d24177ac7c16", "comment": "Malware payload (Dridex)", "value": "ed04788ba23d7151937b50187e88a42b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442879, "uuid": "2ae05b61-a2dc-41e7-bdb7-0dfa1c35bc82", "comment": "Malware payload (Dridex)", "value": "70a4a072ac6a730f0abb0b738067a8cfcd1b387faae7b92eaa5201eb6dae5466", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442879, "uuid": "06175e76-6665-47ee-b971-44d70401a147", "comment": "Malware payload (Dridex)", "value": "245cf857deabcad2dca27bb84d615fd1964aa411", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442879, "uuid": "177a52f0-44a1-4921-a176-13bddee65892", "comment": "Malware payload (Dridex)", "value": "b09023cb6c909bc64d9fe07652238cd9b6a2b1714b7445e4549da65775ce5a65ec29a74edb2d0250067ee3331575c326", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442879, "uuid": "8d2e6868-77fd-4a43-8b17-9e22b164abea", "value": "10F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442879, "uuid": "90e1a077-8513-424a-9417-c2aed42fcdc7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442879, "uuid": "99077022-dd19-431f-9c4b-bffba1aa4fe3", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442879, "uuid": "2254efe0-0e09-4db1-95b4-c08c9e8e8b52", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442879, "uuid": "c980e5e4-ee61-4d17-b9d4-3c90e0ccb49d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442879, "uuid": "7a15de97-a67d-4587-8bda-75b0190e39c9", "value": "ed04788b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb01c73-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442862, "uuid": "30db3d35-6b9c-47ed-8017-7cbaaf09298f", "comment": "Malware payload (Dridex)", "value": "8408cf8575307aeb6d6ba743e3a2b2fd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442862, "uuid": "9ffe99c1-9c26-4877-b6dd-70ecaff3b403", "comment": "Malware payload (Dridex)", "value": "70b74abf51c2d206baa7aeb50c92683b67e9e0bf9c2b477af3607581d6d410c4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442862, "uuid": "c72a7f12-87a3-4654-8c8f-c229c87ab41f", "comment": "Malware payload (Dridex)", "value": "0fa741531ad7947de22435303962166b3e676b16", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442862, "uuid": "385fb92b-d966-4e85-9f5a-638afd4f6f33", "comment": "Malware payload (Dridex)", "value": "bdc0a9ecc5f5ffa62572815bef0e9dd9b057721d82c7b1bff1ad11ea787218fc028aa36b5586545b5968b6da16acb579", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442862, "uuid": "25ae5794-4b09-4768-84e5-e4e3c39ada95", "value": "B4F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442862, "uuid": "5e5e13de-7833-439b-9286-e59f7b53b858", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442862, "uuid": "ffe98a20-1ac5-4e3a-a4d6-bfb71a2b97be", "value": "3072:YWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:Y42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442862, "uuid": "967ec615-73b0-42b7-884e-cbf5d8bad942", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442862, "uuid": "126accf4-6b6f-4d93-8d73-dca3fa6bb11c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442862, "uuid": "8fc3355f-a49e-4d24-98cc-7e4fe0490135", "value": "8408cf85_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964b2b63-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489662, "uuid": "8063ef65-1109-43b0-9c63-d72fb304c62e", "comment": "Malware payload (Dridex)", "value": "a10b4907841bf14bc3ca529e672cfebb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489662, "uuid": "5e0ae6ec-a06f-4949-82b1-2fdb951acfbc", "comment": "Malware payload (Dridex)", "value": "70ea9b22ac28ac987994e8e18f3b2cca3c320c5b9577244624eb440066b15290", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489662, "uuid": "82eae6d6-c5e2-4b7f-90dd-72100052bdb2", "comment": "Malware payload (Dridex)", "value": "e2f54b6a611d8e0c11500a2858ab787c037c66c3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489662, "uuid": "5c4443d3-5d12-4fb4-be16-1dff7438bef1", "comment": "Malware payload (Dridex)", "value": "fe66ce36e4a8d711f418dd1bbf49fa36e6aefa0c6299126d8115a1156d652cbb532b3ce8584d1ec02f5a427a8bca916a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489662, "uuid": "36b918b2-cfd5-42c5-b421-d3b4f300d6eb", "value": "0EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489662, "uuid": "1a1e4638-a4d4-4487-b4ca-8303a72970e4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489662, "uuid": "978c1d57-bf27-42d8-b46a-08a71eb3c1e7", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489662, "uuid": "56020648-bd96-4204-b4d4-00497e6a43eb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489662, "uuid": "a2f4467f-6011-4226-80ae-aadbbe9244a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489662, "uuid": "98aafdc9-4d6c-402f-89a1-af4301c207a4", "value": "a10b4907_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6ca422-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457378, "uuid": "00a96f4d-577f-487f-beb8-b3d174071f82", "comment": "Malware payload (Dridex)", "value": "65ec2ab5d84bb3c75efe0eee6d4df5ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457378, "uuid": "1803f941-8db8-4a76-b517-017dfa3f7b44", "comment": "Malware payload (Dridex)", "value": "7127314a0010656c091ae5086a32a48a83936ae71dc202337c84de8574d205f6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457378, "uuid": "d79ea3c0-297d-48bb-bec1-243e65406e6f", "comment": "Malware payload (Dridex)", "value": "c5987d1ee35ccd97acc417d98531052904302e71", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457378, "uuid": "571ebb46-8402-418e-b07c-0034f2c57ecb", "comment": "Malware payload (Dridex)", "value": "caf22a7b60d49ada61c3508b2e10d3bdacc5301e748beaeeb0b625c51aaeff585da089deba6a9f89aee37ac2d5412ac7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457378, "uuid": "fb2f468d-aa86-4e1a-a1af-69a2e9539932", "value": "CAF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457378, "uuid": "35979b44-4828-47d6-a55c-f3c40e69a10e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457378, "uuid": "c7f16552-3bb9-4c6c-8441-e2bcc57d3045", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457378, "uuid": "1ffe5885-ae2f-41b5-8714-94a10ca3ffe8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457378, "uuid": "9a6fd027-1a0c-4b44-b540-d768f3062613", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457378, "uuid": "062c5621-0ef3-4e10-b9fe-acd943800095", "value": "65ec2ab5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100d80f4-b041-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620507905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507905, "uuid": "9cd13e04-cb27-4465-8cca-dfb5c93cdad6", "comment": "Malware payload", "value": "9f9a1f2c3a3d387afe3e06579c927eba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507905, "uuid": "72dd42a4-3186-4229-bcfa-e21f7cbf6d68", "comment": "Malware payload", "value": "716d7eb8e94458df675400778218c7ce763dc77c2cc4d35dce784e113151a382", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507905, "uuid": "8c95d39f-f639-4e2c-8107-9069742fda2f", "comment": "Malware payload", "value": "febfca477061908a67226dc83578464559341d67", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507905, "uuid": "6a4c38b3-bd2a-4822-ba78-164231bae9f7", "comment": "Malware payload", "value": "e6dc6c5bb03e48568a32b4e8ebbe7b151fd8c0bfb845b2dac5dce1cfe0d2d4237530f0bf0bf3351f6d35137deaad5024", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507905, "uuid": "c890cd76-ec48-4769-92e5-89b094e73a73", "value": "F5F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507905, "uuid": "21ecaee1-b983-49bc-9153-acc09b516c5b", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507905, "uuid": "ce8917e6-96d0-4d06-93ac-706df8dde750", "value": "3072:7e45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:a4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620507905, "uuid": "5210d276-1ff4-4979-8416-d394bab7faa5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620507905, "uuid": "c947cf65-4825-4971-bb8b-b9dbc16eebd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507905, "uuid": "0e705c0c-0522-4396-b300-4382c2383442", "value": "9f9a1f2c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5139d75-b026-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620496585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496585, "uuid": "3341ca6d-5be7-4b96-8a85-f851a74bddf1", "comment": "Malware payload (AsyncRAT)", "value": "70c72fb1a903c4c9ec56f278b04a969a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496585, "uuid": "801d749a-d65a-4429-80f6-0fe7585df157", "comment": "Malware payload (AsyncRAT)", "value": "71cfd2a5a94ef0b3b5ae4dc6211ca8c7cc71f0df86bfb4acd2de845985dc8e55", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496585, "uuid": "6194ca02-e14d-4aea-a22a-b0806b93cc52", "comment": "Malware payload (AsyncRAT)", "value": "2b9ae630459f817fbb9a4261e038243e922a0c69", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496585, "uuid": "77bbb07b-df10-4a70-9085-ef1ee7fb5e1b", "comment": "Malware payload (AsyncRAT)", "value": "dc0e0a4d6d42b3b3ba0d497664adb616ce883b534a9d045acd67ad4c15411b4b7bc9da39dfd8c2488d96af674731c09e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496585, "uuid": "4e2c6d41-ba66-4119-8cae-c5307c3bb10f", "value": "4B018BA7238C9A16215165653334B0704F1A71486C3FB327D0BDE9E1262EDCE1149F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496585, "uuid": "c4898e0f-6b4e-43db-bf87-453c03320ba1", "value": "12:wPaJgCBJJqyAvxaErO+WcAavFHjdGNbogYvARCZLf:wPaGfDFrOtc7g0ARQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620496585, "uuid": "22d0ed21-df7b-466c-baca-18fb13fff21c", "value": 680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620496585, "uuid": "d10d0da1-53ca-4de4-bc3e-47113d7a2a66", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496585, "uuid": "6d191e5e-6f2e-42fd-8a4b-3430aadf1de8", "value": "AT12.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd916e4d-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471689, "uuid": "e005ce53-facd-432e-9628-5582b9df8d4a", "comment": "Malware payload (Dridex)", "value": "9235a686dae36752ac48c463bd22c310", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471689, "uuid": "ab2c663c-d458-4eca-b81e-2fca8b0f2d04", "comment": "Malware payload (Dridex)", "value": "71fba7218c8c823138774554e10771005d3b43b05f85e3f5dc9616c82a243665", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471689, "uuid": "1e802476-90a2-4ec4-a729-7dab958029a7", "comment": "Malware payload (Dridex)", "value": "6a5fab35cdf96ea621f8b9235585f6909aeb84c4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471689, "uuid": "6b69cee0-fc30-4a61-a61d-bbafecb2cbb5", "comment": "Malware payload (Dridex)", "value": "9d44c69695112fb774b384d7a8b164e5fe01ecfdffae31fcdd1d0e882a79b9867da654c51b0fa895e9f4394981653563", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471689, "uuid": "3fddcca0-a419-4ea4-9893-f6f88066e3c9", "value": "8EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471689, "uuid": "ef87594d-c8d4-4ef5-be0d-4432ed0f398f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471689, "uuid": "fb178255-db7e-45ed-be77-4679afcef561", "value": "3072:Mlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Mlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471689, "uuid": "e356b9b0-eb74-44f1-9dd7-db16bd4a4f33", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471689, "uuid": "1ef3eb96-eb0d-4a96-be9b-945f98d75f7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471689, "uuid": "b625d3da-4928-42c6-bdeb-ef4f4057350b", "value": "9235a686_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0343a770-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620475242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475242, "uuid": "99f26af1-7f17-4f3a-b19a-c4e6464c5f49", "comment": "Malware payload (njrat)", "value": "b8b1b82d8bc9a9c9596fbb80c79f5df5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475242, "uuid": "4ca7f8b1-105e-4493-afd5-c13e5481a376", "comment": "Malware payload (njrat)", "value": "72d04494280544c71bee4e58a7de62271a2e4db049177da6bc5a7e933e56636f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475242, "uuid": "10cdc220-a4d6-4091-91ec-fde758b642a5", "comment": "Malware payload (njrat)", "value": "6fec576b5d5cf00b6dfeb5446679f33559b6904f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475242, "uuid": "46d5ecd5-7f77-48b1-8a91-d48b2033cc27", "comment": "Malware payload (njrat)", "value": "6640c5378bafceef4ee99f579e27d61955013ccbc356469d99ad425232320239f0d7b6f4e9b4ec39be370c75681cc988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475242, "uuid": "9937efcb-3d6f-4dce-a336-703b02ba952e", "value": "4CA543505DAFD94FE7687B700BC885C98C073D846C726482EE8D9666C763FD0EAA4B34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475242, "uuid": "767513ce-6c50-4f47-bf45-941c0db5cbcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475242, "uuid": "64ad767e-56db-4c39-9e94-a2af9708d55a", "value": "3072:JxThxUTAzHSGox/C0wdvMqLD2T/ZS50M5anf3/L/5p1CudpSjnIiYjI:dxdLzosFUqLD27etav/hXSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475242, "uuid": "543c8f76-93a7-421c-b592-9b6a4fedb705", "value": 2143232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475242, "uuid": "1bdaa9e8-77fe-46b8-935e-ee28150b016b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475242, "uuid": "f927ce1e-f646-4f5f-a86f-82381e12074b", "value": "b8b1b82d8bc9a9c9596fbb80c79f5df5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fcdf77c-afbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620451265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451265, "uuid": "4546bac1-70d5-46c2-9c51-05d9b15fb252", "comment": "Malware payload (AgentTesla)", "value": "6487f113dda7b69b9404d218d525fbf2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451265, "uuid": "125b6cc8-0377-4440-a3a6-4f87ff511e09", "comment": "Malware payload (AgentTesla)", "value": "73f765a9c4713b8047fe5f71e0bd38426f230df062b6e291990dffe6e0836ba8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451265, "uuid": "4821a309-c733-4414-ac25-b4b3dc3e158f", "comment": "Malware payload (AgentTesla)", "value": "41a5f774a8e613f19119e9515bfb8fc021ddde9f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451265, "uuid": "9284607a-0d33-474d-a8f4-24e040d5fafd", "comment": "Malware payload (AgentTesla)", "value": "491d15c9bcf39731d417d408c528b15e8c70211d0009b5e31e0edf3133b0710ba5be45f93978881d1cb1ab4b41a2ef07", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451265, "uuid": "b779c7b6-f918-4ea5-bf21-90d9e9aaeee0", "value": "B0E433681D216D8D4F873B3DF8BB264227197D16E9B2160B25C130DEDA2C41E728E7ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451265, "uuid": "3bf1ea46-ca70-4aef-a318-203946d1178e", "value": "12288:BxQLmf01lxx9JISwq0LCrfgIj/8uVISyQlfImQlL1pBQbxJbVewK0jGYXFWEz:fQLoWxx3prfB8ueSxbw7ObUMT1WS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620451265, "uuid": "409d4519-0b35-4e09-9136-d6e47e455335", "value": 668352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620451265, "uuid": "4103d4e4-b7c0-4b76-bfef-51a45a74b774", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451265, "uuid": "e2bd20ce-c1c3-43d0-a336-a8ffc4459ccd", "value": "BL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1240372-afb1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446435, "uuid": "346620ee-d5cd-4791-b805-276a5ad2d75a", "comment": "Malware payload (Dridex)", "value": "0f242986ffea8d6cc912ed751351a7dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446435, "uuid": "8d0d19b1-9260-418f-93f4-c9cf518877af", "comment": "Malware payload (Dridex)", "value": "743baed1788c1d86f0a560513c9f737bd4e7c63d1772891e92014a40ee7c8c33", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446435, "uuid": "572fa893-4d99-4b9b-a489-899ba7a6f85b", "comment": "Malware payload (Dridex)", "value": "171a86e5ca58a4b46d7628df24521cd494e09d48", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446435, "uuid": "e17624f7-0ca1-4726-8664-5f2a6216735b", "comment": "Malware payload (Dridex)", "value": "3fc9d86138a8180d482f59e30959fea68d4b7894b8ba20aa8fe67e22038b0b5ed59456b69cebc029b041f097b69f1278", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446435, "uuid": "d7ae2846-31a6-4bec-85b2-688a4ec265c3", "value": "A3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446435, "uuid": "53e0dee7-35a2-47aa-b551-4b67206280d7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446435, "uuid": "018f2cf5-d542-419c-a8c7-25e3eb4b8baa", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446435, "uuid": "16f762c6-a408-46c1-bb13-54692ea4116b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446435, "uuid": "c3a6a8b5-a7d9-419a-a86c-e0794c6eb855", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446435, "uuid": "05876bc3-862c-4163-b87c-d4023c319d6c", "value": "0f242986_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c690ea4-afbd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620451232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451232, "uuid": "d85248d3-efc5-4554-9301-d0a7213882d7", "comment": "Malware payload", "value": "27b92aecb28c063170b6d865ef4a26b3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451232, "uuid": "fb5aadad-afbc-4545-be9e-7bda83047be1", "comment": "Malware payload", "value": "7461266e93612e2cb4beaf289814b889266ce67eba5e28f82219fa74d8012afe", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451232, "uuid": "e1ab4ec6-744c-496f-8003-7c9261159db3", "comment": "Malware payload", "value": "883d24c3b4e3b16d7461f859a0359bad52f42172", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451232, "uuid": "a64177fa-2e84-4f57-ad67-10d9ffafeb67", "comment": "Malware payload", "value": "831bf3202726ea25d4c92687ee66c09c82bea9fabc0e56d000d26fdc541e272f95c91904382b5d8b2abb35e1042c09db", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451232, "uuid": "2c8adc42-7fd6-4331-8206-deb79512da53", "value": "B43523407562E731CB292F78DE997A81C0EF960B6BAC965F967CF8F3C032EE45452640", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451232, "uuid": "1496e232-105c-43a2-a5f2-ca17c6d8470a", "value": "bc2507952c5954f0ae664ccf1c638c93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451232, "uuid": "ade994c0-9b70-442e-a5be-df7c201749c5", "value": "24576:DRBrzwX0YmJI8DRnCD4jtnT8Q1r0ly78ipwR7:FJzdnm4lT8Q1r0pieR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620451232, "uuid": "5151ac29-709c-4ce5-a3b1-db18987431d8", "value": 1115136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620451232, "uuid": "f8d0609a-b58e-4fd7-8d3d-56b2c9e7b77e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451232, "uuid": "97ab387b-4c98-4cd8-8073-8078511a054d", "value": "cpu32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9e3da0-afb1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446432, "uuid": "20f425ad-e17e-401d-8d88-34a7cd39ae3c", "comment": "Malware payload (Dridex)", "value": "9a6ebcc60e1291f4b1d67428c4727c1d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446432, "uuid": "a52d79b1-90f6-4cb2-b3fe-a547fe8c0c4f", "comment": "Malware payload (Dridex)", "value": "7478d7c600c2343b4c204c966d923ae436640a5bcc2e335886243d972430d10d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446432, "uuid": "6b3f78ab-cd52-48eb-ad18-3faa7861d221", "comment": "Malware payload (Dridex)", "value": "d6f8d193ac0e8d9a8189eabcf77390c5d0e37fa1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446432, "uuid": "b38ec7a4-8252-4509-b9e9-fcb8b9baf01a", "comment": "Malware payload (Dridex)", "value": "cde2e700b77cf6ab13b8bea11dca371008a321b82e63dcd3c2f76e036b1375972a8f8f53cf6b01b6477c28fff9b47987", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446432, "uuid": "429446e6-19d3-4507-9afc-28a868810e01", "value": "A3F3C141C9C5CCF0CBE36C3A4695963B3228B541995A8E42EC64CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446432, "uuid": "4cfdfd83-ffe7-4275-abe2-3b8d7bd75d7a", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446432, "uuid": "0e9fcc73-20da-46bf-928e-2e030049ae54", "value": "3072:BuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+HY:B0czbty9uiaJlOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446432, "uuid": "6d86a193-888d-46e7-aee9-fdaaa5b9ff2d", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446432, "uuid": "32288a45-6b47-4c4a-bc64-db95ecb0088a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446432, "uuid": "3548b06e-669e-4953-b835-0bf13df6f17c", "value": "9a6ebcc6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c64c708-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442857, "uuid": "85c486f3-1b46-4789-9431-7d6a4c273b1f", "comment": "Malware payload (Dridex)", "value": "840c1decd0881bc85db5ecdc57477a0a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442857, "uuid": "438f26a7-e7a2-471d-8efd-986c9e63c734", "comment": "Malware payload (Dridex)", "value": "74e1061d516a3f5b35975c147587eedc1be03de93eddb49e9aaef6f53e207f30", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442857, "uuid": "dd9408dc-d892-4e8b-856d-b32e4b97bc0f", "comment": "Malware payload (Dridex)", "value": "a2826a8ecf12adc966fd558c0563435765cbdd8b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442857, "uuid": "b87e1503-f008-4142-bd8b-8f1e80d90046", "comment": "Malware payload (Dridex)", "value": "861a4c24a8a719060f98e69508493776fd5e4bccb101e616834e719fcd49101c288d2727eabb167368cc4fa45fad5bee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442857, "uuid": "280e530f-c76c-47bc-87d2-23142e1cecd7", "value": "E6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442857, "uuid": "4cdeaaa7-2355-4059-9d9b-d95a2bebf765", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442857, "uuid": "ffad92f8-b292-48e1-8b11-e756b8b075a4", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442857, "uuid": "a707b280-089e-4201-8599-553c7bff96ca", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442857, "uuid": "0a936767-51e1-46d6-8a71-3dce5a879990", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442857, "uuid": "63ba0dec-84ee-4579-94b6-8a42494d32e5", "value": "840c1dec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114dc9cf-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475265, "uuid": "89fd9f34-8a56-4aeb-a46f-367bbceaa16f", "comment": "Malware payload (Dridex)", "value": "8df876bbffe96aebed58cd343ba38d28", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475265, "uuid": "34ed170f-34ff-4be1-b97c-07e134cc3627", "comment": "Malware payload (Dridex)", "value": "75be1c5ab4c0cb76ef9f06254b5840d727fca0aa390e55cb77774d45beca383c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475265, "uuid": "7e83f434-b92c-45ba-982e-c76a4c511163", "comment": "Malware payload (Dridex)", "value": "1d73e34e1e1a2c3af35fdd9608f226a2b3203aa7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475265, "uuid": "e6a1ff60-3170-4676-97dd-1dba5ac7ae2b", "comment": "Malware payload (Dridex)", "value": "46e36f48d197bbc25e8ffbcf3d94ce3e2fb5282b54c5ecadde8c52bba31e3c301594d78c54560548cf38c654d5d191d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475265, "uuid": "5eee7be4-d533-463c-a7f0-cb336dfbce99", "value": "B6F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475265, "uuid": "8da2a19c-2474-484d-83b8-2eac18e86f24", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475265, "uuid": "519f107b-5ddc-42d4-bf59-687f066eefc7", "value": "3072:6WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:642IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475265, "uuid": "69049b24-b773-4fdc-811f-d8610a1f945a", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475265, "uuid": "1c117bdd-4948-44b3-b66e-695a180bfc53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475265, "uuid": "303b7cdd-73c0-4c97-9a07-09b7f1d168a0", "value": "8df876bb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3456fd5d-afbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620451272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451272, "uuid": "ecf31d1b-4023-44b7-a4c7-3199d7f818fa", "comment": "Malware payload (AgentTesla)", "value": "7fc435c52ddfad42af6e7d290486beb0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451272, "uuid": "2762d8c2-1c24-45a2-b9dd-f8e61900fc62", "comment": "Malware payload (AgentTesla)", "value": "76184a1554ddbb339b8df5b47538c78621c515fd4825302f94879f781148db4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451272, "uuid": "78dcb3bc-007f-4c27-bd5f-641e31f7a629", "comment": "Malware payload (AgentTesla)", "value": "0b6f6274723ae9afbbb720d5a67594a3885b4c71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451272, "uuid": "709229a2-6353-45bd-a1d1-1cf7ba41717e", "comment": "Malware payload (AgentTesla)", "value": "7fedf3e3b61819974a73d289ca0d9f830494bd88818d83228ef2053f36d411e037f529b7f307b34821d583c1217bb951", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451272, "uuid": "40f9cde2-6483-410f-9c81-e6afaac2082d", "value": "92F4126523A4DF19DABE2B3D4172520813B4F216AF63D70F6FD464FE2E23B889106746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451272, "uuid": "b744d3cf-d1f9-4eb7-a1db-279d1629b51a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451272, "uuid": "20d4e2ec-f090-44bc-ad08-7c9bd1ce1e84", "value": "12288:ENGDxMw0Lef01DxR9/y0AqOLCLZOIj/aq3Iuy0lfImClj1dBwHxxbV+KKajWYOrp:EExp0LgyxRZPLZ3aq4uPbkLyH8kLc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620451272, "uuid": "eb6270d2-0ab0-4233-97e3-240263f93838", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620451272, "uuid": "8248ee2c-5ffa-4411-b0cf-ace7e8ddf79b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451272, "uuid": "66836ba5-6e45-4ee0-88f5-2afe5c5c5694", "value": "Q1EQNqxSSwsY2r5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da0728a-afb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446483, "uuid": "bb279875-a408-4deb-b61b-85cd72ac71b6", "comment": "Malware payload (Dridex)", "value": "9eb2e2ac2567dcae68a4398f9ff5868b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446483, "uuid": "1fbe5188-edc8-4961-b833-c6ad6b514924", "comment": "Malware payload (Dridex)", "value": "76648549a191bafef413b8d695f82439b3b01b898891f70cc63e57e1994f1902", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446483, "uuid": "ee79ec0e-751b-4b90-b40b-3f42633df3b9", "comment": "Malware payload (Dridex)", "value": "5e95850ef990b3e4bbd831b16f9ff23a1664e265", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446483, "uuid": "02dbda64-39a8-4d41-8138-0b65458a6423", "comment": "Malware payload (Dridex)", "value": "21569b125a7a988c15b155c016eade3ca93c06864b8006561e8e46824a062f86abb8132b5a6ddc492832854db7cd034e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446483, "uuid": "1e14114f-4d5d-45c1-97a4-8df6c54d187f", "value": "DEF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446483, "uuid": "c8669532-a4e0-4ef0-8408-27d3ab0c77cf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446483, "uuid": "e17bd49f-4580-49a9-96fc-81ef73299cb8", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446483, "uuid": "460dd247-7a79-4e09-a07b-d72f88ff6d83", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446483, "uuid": "f0c28f18-143e-48dd-9f40-564ab007d879", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446483, "uuid": "65ecbde2-5354-4207-ad26-0a6baba02223", "value": "9eb2e2ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6858d415-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620457372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457372, "uuid": "20aa1cba-f221-48e2-8a41-bce532217acd", "comment": "Malware payload (RedLineStealer)", "value": "d7cfcefabc22cecb94af7cc290bef648", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457372, "uuid": "d8ee9f4e-ea34-433d-8db6-240a99c85fb5", "comment": "Malware payload (RedLineStealer)", "value": "76919d1b955f642d02652b03274a9d447d386b8071d1f51f41a22cc708a7db31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457372, "uuid": "e19b3976-6ccf-45f0-a772-ce5b2802fa7c", "comment": "Malware payload (RedLineStealer)", "value": "45844bd2f247d3e62e6d90762c84187e7f6c83cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457372, "uuid": "5f868a38-9c7f-48a1-878f-832e63cf4496", "comment": "Malware payload (RedLineStealer)", "value": "1e6171ee8fa20c9979f63e93567e97537bd62a71f97ecc99cd1a516483f0cae8b19aef117e13374cec9ca5d18ece2fc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457372, "uuid": "bc0ce38b-d16c-44fc-a1ae-d91ea34704a0", "value": "0D14AE2075D1C1B3C4B7113484E6CB7A5A7970720B7A91D7B7DC2BBA6E113E1A3362CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457372, "uuid": "3809b021-6c83-49c6-b9a4-81ad5bd379a8", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457372, "uuid": "e9516f75-7617-4a1a-b3e6-7ea1bc59828d", "value": "3072:EDKW1LgppLRHMY0TBfJvjcTp5X4l8MfmrAfN1PB14uVXk2GB:EDKW1Lgbdl0TBBvjc/DfeN1PPVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457372, "uuid": "9582a0d7-6a03-4be4-8bf6-726d0fcceb47", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457372, "uuid": "92c3abf9-e1c4-4723-b29e-8606be8d5c86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457372, "uuid": "87b4cdd8-7a85-4069-bb8a-8471041f83f4", "value": "d7cfcefabc22cecb94af7cc290bef648.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc8170b-b028-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620497187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497187, "uuid": "2f3854de-bcd4-465f-87c0-c80e2e0c5300", "comment": "Malware payload (Dridex)", "value": "7164f45d613e85399f4ac1a2719c0cf5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497187, "uuid": "14d7b8e7-abd5-46aa-a92e-250bbcfb844f", "comment": "Malware payload (Dridex)", "value": "7697929fa6f7f9b54ad4b2b943c1dbe3f975e0b6678a148cf157871544e67b95", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497187, "uuid": "597b6d02-d344-49eb-8a29-cef1bfe59e76", "comment": "Malware payload (Dridex)", "value": "b54b61a0f14b8fa7ad34ee8e14b9e2ba777b65f4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497187, "uuid": "a92c2d86-0d26-4143-8d75-9bf1b8c98fa9", "comment": "Malware payload (Dridex)", "value": "c862dafbc1e3bba0b98637c166453db3a3482b26917bdb9d0a4157d05e96d249ba2b9b53f7162b2da33db9a8713a7d4c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497187, "uuid": "3c5fb85a-5370-4cd2-b370-f3b94cb58376", "value": "85F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497187, "uuid": "8fed4cf8-0f16-4adb-b7d7-7d38a57d4199", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497187, "uuid": "6744aff6-e514-4ae5-9424-60073fbebe8f", "value": "3072:RA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:R3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620497187, "uuid": "7435835a-b95d-4fa4-b4a4-e0b49e5572a6", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620497187, "uuid": "fad8c203-52b1-4ec9-8f0b-cb51bc97b661", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497187, "uuid": "7570680f-a84b-4897-8325-16eb3bca679f", "value": "7164f45d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53270536-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475376, "uuid": "129893dd-65cf-4295-befb-0fd09aeeb3db", "comment": "Malware payload (Mirai)", "value": "3cc1cdfd3fedb23aacac8e6ccb0ecc98", "object_relation": "md5", "Tag": [ { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475376, "uuid": "2d8b0a5d-3170-45ff-a5c7-efbdde400dd0", "comment": "Malware payload (Mirai)", "value": "774944a15af6142f674c24a1d99be47857003fde9e54e53ef828a984ff142f72", "object_relation": "sha256", "Tag": [ { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475376, "uuid": "8a2cf1a2-825f-4322-92ae-05dea2c499e2", "comment": "Malware payload (Mirai)", "value": "df3a986ba2525f1561935a990ec08ad84df79eeb", "object_relation": "sha1", "Tag": [ { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475376, "uuid": "5502dac0-8ba4-47fc-beb3-12f8aacd43ed", "comment": "Malware payload (Mirai)", "value": "f4d2eff19934f4773e9bafa75027ac5133b5b169d97093858b0d3971b2229c1a823e075673926fd4a61cc35511f2770c", "object_relation": "sha3-384", "Tag": [ { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475376, "uuid": "e1a8c880-d56a-4909-a105-f35cb6e99ea7", "value": "BB332B8968121E2CDAD358FD50729F4E9E551321A0A3070FA7ABFDC33D33269EF55988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475376, "uuid": "af5d0b1e-bd9a-44f9-ada7-c085cd076f83", "value": "768:mkuzcCLmgr/BIGh6HHaihHHeIXXdauZj0CGeWxhyF7BtM7edUo+f1prnqvQeHbR:mkqcC3rJIC6HHaiFu/ey7edJg1pLqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475376, "uuid": "4dbf1874-2fb6-469b-9f17-ed742a4fd1a9", "value": 54336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475376, "uuid": "20415d05-e70d-447c-ab3e-e85300ebec8c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475376, "uuid": "3f7b2f21-2296-46c3-b748-c7de0546d31f", "value": "loligang.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b4a48f-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471644, "uuid": "630aa6e1-871c-46b3-abfa-e883fd6e499d", "comment": "Malware payload (Dridex)", "value": "244ee5f6a54f21ab5fc4f3f7cd751ad7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471644, "uuid": "2dc1da0c-97f6-421c-8475-3fbdcdcca36e", "comment": "Malware payload (Dridex)", "value": "775faa8a05d859bf10d384fa370831b31ba7745dc50d51f5f9a7234909a65892", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471644, "uuid": "f5cee6c0-49e3-45e8-95bb-6b9099e218d2", "comment": "Malware payload (Dridex)", "value": "ac494d799a368813165b4f50eb2ed6cd6a0e7f26", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471644, "uuid": "8220633a-3773-4b2a-9b98-2ca68f815de8", "comment": "Malware payload (Dridex)", "value": "ca715c62da81ffb0a58f48540a7922b467bf7a5e9ad3d621ad39d251fe7a69bcb9abdd54d8d4637de7daffafc3e5d2f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471644, "uuid": "47eee5d7-50c1-4293-ad90-20508031d229", "value": "8AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471644, "uuid": "ad8d6e7d-e618-4bb1-ad9b-3051dd2f6d69", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471644, "uuid": "14a61088-60ef-433f-ad00-acd719c5eec6", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471644, "uuid": "4d5e8d95-7d94-414d-b126-88a27fb62dfc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471644, "uuid": "df603ac6-c25a-412c-8b4a-47d0ebdf9d64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471644, "uuid": "1b97fdf5-679d-46cc-9ee8-11940ec2addd", "value": "244ee5f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561fc1d3-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457342, "uuid": "dedb2fd5-7501-468c-ab21-1b4037fec289", "comment": "Malware payload (Dridex)", "value": "239d49cee7281fdf4ecb3a96c29aecb4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457342, "uuid": "4b22a6ed-18c6-4b9d-a349-e9d965c0a807", "comment": "Malware payload (Dridex)", "value": "77931c12dce282a3e523f1b250b8165377b8f4d54754430823752793d0d74573", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457342, "uuid": "3f20174e-8420-4329-9482-eb31a5859c5a", "comment": "Malware payload (Dridex)", "value": "87123eff597f2305fb79e8df7b71292e92b439ed", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457342, "uuid": "de114777-d992-4e21-9495-fe9fb1a28f81", "comment": "Malware payload (Dridex)", "value": "cae03b5e379f43aa6d9027d48675f19f773aab9a285d88480b7e60f7e66d82a36c5c106f31262929e83f2f5cc9c26d6a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457342, "uuid": "055adf07-157c-4557-962c-4f3ac10e899c", "value": "1DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457342, "uuid": "bd2c35ec-3fc1-4e46-9daf-3f30c683e816", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457342, "uuid": "2f246023-fea0-402d-becd-2299231a09b0", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457342, "uuid": "776b7c71-abf5-4f21-ab16-4176d4625cae", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457342, "uuid": "0d8555e0-22c4-434f-9745-61aa19161f2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457342, "uuid": "b85dadf4-f08e-4cc7-a6f5-e6cc7eb3c7e4", "value": "239d49ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c30f39-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475273, "uuid": "8e33e999-5d12-4b00-83b2-d3471652cf53", "comment": "Malware payload (Dridex)", "value": "7d721234515ef0922377dfe317be9f91", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475273, "uuid": "940be484-1d6a-45ba-b3db-4717d84ea3cf", "comment": "Malware payload (Dridex)", "value": "779dd74922a714c6e19febaa8750a52d7966879e1b53285e72ef72cc17cc13ee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475273, "uuid": "1ab11f87-2641-463b-8c5c-ddbdda88bfdb", "comment": "Malware payload (Dridex)", "value": "093566e731320493dce444a9da395d2fe2b89fd7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475273, "uuid": "53ca35a0-5770-435a-ace1-63921b82a9db", "comment": "Malware payload (Dridex)", "value": "2dde62572795b7be19d907d1c453e8ed7afb5d1e6708c880723f70a8487edc4430c4eda7e6aa9950d9276691704285ac", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475273, "uuid": "cc4dadec-ae98-4b5b-9ae2-345b5a2dd14c", "value": "D3F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475273, "uuid": "6f436cd0-ac23-477b-b29a-e7bbdaca794d", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475273, "uuid": "31d56533-3a5d-4268-845f-18aed18c2b0d", "value": "3072:GA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:G3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475273, "uuid": "b981321a-40c6-444e-aa45-55b047764cdd", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475273, "uuid": "6906391f-640e-4458-814e-5497b2361b8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475273, "uuid": "48d1376c-045d-4730-accb-ac721cbb800f", "value": "7d721234_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32531ce7-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486058, "uuid": "45279106-e2d8-4d92-bf5d-402c47e3dd7b", "comment": "Malware payload (Dridex)", "value": "98ab2e2ddde7d58baf12a590a39e3b64", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486058, "uuid": "56465d91-87b8-4d1a-8bce-9c829bbbe0a1", "comment": "Malware payload (Dridex)", "value": "78381d7fe063dbaf92a71159fe62aba013ecf9d96965b49b014308ebb5adc522", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486058, "uuid": "d870081f-ac7b-4dfb-bf2b-b82e92084702", "comment": "Malware payload (Dridex)", "value": "7f4ddf3040fb2ca868260e2030aa8706e971c155", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486058, "uuid": "21bd8006-edf6-4b44-b1d4-3318cc65d578", "comment": "Malware payload (Dridex)", "value": "ecb07d1fefd18ce3d58f7598bf31275fd1fbfbe3c3f65337ff7a65409333f7c40db858f57e8671c819b08986bb1ac67c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486058, "uuid": "8f8b579a-f2be-4e9b-88fc-2cf7bc1c60c5", "value": "56F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486058, "uuid": "0bb6b119-fe1b-42d6-9c0f-31c726c1a607", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486058, "uuid": "fc9526e0-2afe-47aa-98c3-fa7ffc66f70b", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486058, "uuid": "0a4f707b-a0e4-4e32-b156-055fca844613", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486058, "uuid": "4ab0b1c8-7489-4fd2-a01d-e0033226b35f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486058, "uuid": "70f5ae97-fd1d-487a-a654-166ffb405796", "value": "98ab2e2d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062d40d5-afb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446470, "uuid": "dd0ce1b8-e873-40a2-9621-b2cc316cb833", "comment": "Malware payload (Dridex)", "value": "c86a8f89d05e698a3b8a783566388c8c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446470, "uuid": "2d938638-e9c6-4d56-841a-bf31ba0bbb53", "comment": "Malware payload (Dridex)", "value": "786a7ade021d9d1c86213229b3a94b2a956894a202063838d8389375bd3085ef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446470, "uuid": "c63b20e3-c718-40da-8964-4f3f563045aa", "comment": "Malware payload (Dridex)", "value": "b64c3d0859948edcc4e75993c20680ce24786650", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446470, "uuid": "94d2f87c-1c50-464f-a2a6-942c4f775c66", "comment": "Malware payload (Dridex)", "value": "e0b1e1991c95dbd09fbd206fb77a6198cc554b7d717b4bd581c702b077e889b914a2a2eb04ab891cf62be52ae5c35bc4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446470, "uuid": "13450213-ade1-4354-a3d7-3c6032728620", "value": "E6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446470, "uuid": "e2817615-6ca5-4f36-9a65-0b1e45e723e5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446470, "uuid": "e043d31e-0b04-4252-a67c-10f1bba42d35", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446470, "uuid": "36686afc-5929-45db-8ed5-b8c374659ebc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446470, "uuid": "c7c372a1-91ee-4262-aede-6a8351f4a549", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446470, "uuid": "83142e30-431a-4087-bf7c-e7dfd6b5fd41", "value": "c86a8f89_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53727c4f-b020-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620493845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493845, "uuid": "f564345b-51e5-4b66-bc34-499719f248e9", "comment": "Malware payload", "value": "3eefbbd7d038300787e2e063059eef7e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493845, "uuid": "e3c409a1-5fc1-4729-b79c-f12dbb9bb455", "comment": "Malware payload", "value": "78928953ff499de450056db7bddde2d759eddc13034ec77e43e9dafa31e2a01e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493845, "uuid": "e33d6b61-50fc-4dad-a15c-a28acdf3cd8a", "comment": "Malware payload", "value": "c64650adaf50f9f0a4deadb1ef2af04f250b49d6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493845, "uuid": "9d19fa96-2e07-4416-bb11-d42848937d1f", "comment": "Malware payload", "value": "e04f1ae6a0e72462274cd88c4ed267ca4f9121c66435c19ce9057f0533ac130dbdc5c334c27664ab326c78defc17913b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493845, "uuid": "08d890d3-76f4-45da-a431-be768c281115", "value": "1CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493845, "uuid": "7ec435c8-98b3-4163-a560-dc036574100e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493845, "uuid": "12bcad36-eb32-4e1a-9773-fd818ad3698c", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493845, "uuid": "43387173-f546-49ed-81f5-268a926121a6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493845, "uuid": "e2907d0b-e012-475f-bde8-907b3fc25438", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493845, "uuid": "d0c75c32-b9cc-4919-a90a-657a0184a94f", "value": "3eefbbd7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46532df2-b030-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620500694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620500694, "uuid": "95172ca4-422d-446a-a9ef-4c704d9c5694", "comment": "Malware payload", "value": "b1cc7dc0589f1c2e4dd0236ab1c1936d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620500694, "uuid": "09c22fae-a164-48a4-a70f-4a2f24996678", "comment": "Malware payload", "value": "7897c0229b1989abcf9d63f1947d73337650f00c295ae578ce40a03ad059ac90", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620500694, "uuid": "735de875-4b44-42ab-a672-39c8d3459813", "comment": "Malware payload", "value": "f3309cdf913833cb71a513e1e59f03208a2cafcc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620500694, "uuid": "f151ba6f-7ede-44f4-988f-9a171e58ddd6", "comment": "Malware payload", "value": "a9d9269ced96317e216bd6f7bb65908dd30c51d413f2774b1f0191d30813df2cfc294fb2f1de2b7c202c6b3f893e16c4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620500694, "uuid": "dc9d8c99-8991-421d-9552-6d41e719b9dc", "value": "2CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620500694, "uuid": "95666ed2-5b02-4177-a719-45b15e62691d", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620500694, "uuid": "de0bbf02-3a56-4949-979d-ea518676cd02", "value": "3072:HA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:H3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620500694, "uuid": "45630848-015a-4ea7-aac1-193ec1f59bd6", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620500694, "uuid": "297a705f-6c8e-4ba4-8c5a-273edb32c762", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620500694, "uuid": "98652bd8-9c74-4f9e-8878-000d2b1ab509", "value": "b1cc7dc0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed505a59-afc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620456307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456307, "uuid": "352655f6-473b-4946-8388-ea028dc548a0", "comment": "Malware payload (Formbook)", "value": "aa0494dea5f5ed271c1d648d7ec71e12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456307, "uuid": "b8d0ec91-f6b6-49d9-805d-57012f48a6ed", "comment": "Malware payload (Formbook)", "value": "79adce5b035cc593f8a511be0217da0c1b4686b9215dbd648529c2aa00e04807", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456307, "uuid": "04a3d6f8-3135-46de-bc89-947b4d2165b6", "comment": "Malware payload (Formbook)", "value": "6f4aae17a0de770be7cc7e0ae184cd2d0e47f3c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456307, "uuid": "e968001e-ee22-478b-916d-e7150e3e3cd9", "comment": "Malware payload (Formbook)", "value": "601759491337d10694640be2a3faa8a08b2bf509299f32d8857b7fee532c01560d0a52141e933c2ba5fb9f2de1cdc222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456307, "uuid": "f48735dc-23d0-4874-9ee4-1718100613a4", "value": "AFE49F21A7E15137E0AF1F399C2BB6B95C25FF4129E4604A2BF5BD489F7928138381D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456307, "uuid": "5e3374f6-783c-4131-8fa0-a1b693e3c082", "value": "b124d6d7906bfbfc346167632abb74ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456307, "uuid": "6a0b6654-0598-4355-9a17-e7697be3f6f7", "value": "12288:7L4F9NDkBISBvY6gjo1gsUM6fZdLya7FC3O+U/Oy/c:7UF/SS6bqsxKB/FCzUD/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456307, "uuid": "40c9096f-273e-4d46-b6f3-8998d58dcab1", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456307, "uuid": "8835676c-5501-45d9-98fc-b9dbdae9f7bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456307, "uuid": "59ae5ba0-381d-4273-9407-0286e5a5fea8", "value": "products order pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e2d822-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620460635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460635, "uuid": "7fd972b4-a510-4485-a818-1b7eb5a89f76", "comment": "Malware payload", "value": "942d262973dab9e3b1d475015e4d92cd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460635, "uuid": "04774dfd-bc2f-49b4-b425-fc33503ff03c", "comment": "Malware payload", "value": "7a87934d117e5f192b6268a29e6cf220155849dbed4148bd0b0c38c81892b132", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460635, "uuid": "71baa0db-41cc-488d-b316-68e30bd4d50f", "comment": "Malware payload", "value": "85ac06efcd0024710ac208ef8245d1dddbbf7d9f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460635, "uuid": "5b4b41c1-10d8-49f1-b91f-9b827ac9b33e", "comment": "Malware payload", "value": "6cf8c3e033a88dd49a4d79b774c1991ca1b5d2d34f1a5c19d0d033d4f22856eaf2efda5ee47acca0c1cceeb90807342b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460635, "uuid": "23e437a8-4011-43af-ba20-089591364e88", "value": "17711B332BA3C5B5CB280B3F41AB1AFA32585364174944CE8F93695D2C24DEBE87C702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460635, "uuid": "776774e7-5945-4cea-b821-337dcf5e0dbe", "value": "13ae18cd70fe91312dd8206f2d86742f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460635, "uuid": "534f4824-7a5b-4458-82d4-b56de278e2cf", "value": "24:eFGScwQtyOAwn2XgupDW+Y+KxkzatWxxkzzRXlkUla52XIzK0y0t:iS1cwulW+Y+R5uzRe8K2YzXyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460635, "uuid": "44c11e7b-5f47-4b4c-a97a-b5e3231f72f6", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460635, "uuid": "ec356767-932b-4362-9aed-661fecc90469", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460635, "uuid": "5ae47e5f-1c88-4b15-a199-074acfa86867", "value": "SecuriteInfo.com.Variant.Jaik.45760.4247.25265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b98feb-afc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620456049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456049, "uuid": "13bee26a-e4ad-4cc8-ac6a-11f6eb25c6ea", "comment": "Malware payload (AgentTesla)", "value": "918d853b9b73e95c8baa30734376f8d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456049, "uuid": "cf12d305-9a0f-4721-9f3b-1cbe16255caa", "comment": "Malware payload (AgentTesla)", "value": "7adba0b29eaef6d3b3c0d8a8f977ff97e2f061624a1d8aec32d515a25a1dc238", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456049, "uuid": "72e5e466-61e3-4025-8982-5794063d568e", "comment": "Malware payload (AgentTesla)", "value": "7373c183c5b0d8d64a334b30a1e8e4a0132c9dcd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456049, "uuid": "1519c588-9e3d-4813-be14-e7d13e2a1ac3", "comment": "Malware payload (AgentTesla)", "value": "2153419b1e1edd3e7090af2a4b6a372c697aaaaff1419f7315f4b0565e8e16a68d53775e1f5c949f9172df5c0bbe268b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456049, "uuid": "b436ef0a-e17d-4268-9202-c506dd6728eb", "value": "1F057DBC765465E0E35B5D23A3CF0C0642252274A93BE91E8B6013BE1A67F173E39D8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456049, "uuid": "48914f91-ea34-4da2-a986-6be9436f6f30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456049, "uuid": "a58fe5a9-f6f3-4648-b5bf-e3be2d684aa1", "value": "24576:c1oLAMdUUW/k3S6z2tRD1ZZtxBFC387nbNOqys:favkC6zk5BFCM7bNOqys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456049, "uuid": "5747362f-64a8-4c71-9367-3a7bd2047bde", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456049, "uuid": "b858d00e-6a30-47ef-9811-d45816f632f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456049, "uuid": "1d433b1e-c9c3-4bc8-9809-3507378fb050", "value": "k1ydHuPoXUP2pr3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947dfb95-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478921, "uuid": "f0ec9f28-2c41-4169-b348-17b377b697f2", "comment": "Malware payload (Dridex)", "value": "44674a17a01623d9d95d9d17f8648370", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478921, "uuid": "4774918e-0b11-4d00-ab1f-99116d951bb4", "comment": "Malware payload (Dridex)", "value": "7b3321e1b9e3aab1afbfcfe8bc0d81ca69be5eb00a28147dd052bd6bedfe165c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478921, "uuid": "b890926d-28ba-4860-8525-fa4745b1858e", "comment": "Malware payload (Dridex)", "value": "b872a12ef2eda918f9664e93008c9b97a9597edb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478921, "uuid": "1aeafb09-b85e-488e-af2e-550b85b66bd3", "comment": "Malware payload (Dridex)", "value": "442b625dc1df168f3dca5353bfb46339059724a865b911959b6b720cff533b4071d5d14c84f2d34f6efc77f0a59b4dec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478921, "uuid": "28ab7e15-19f5-4a7e-b6d1-2f3c59342477", "value": "AAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478921, "uuid": "3656ca82-b92f-4ef8-a8bf-74c81b431df2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478921, "uuid": "8e24ea16-9595-46c1-9a9f-ecdd34f7be8c", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478921, "uuid": "a8ebb417-85ea-4948-9290-cc20e63334a7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478921, "uuid": "0738bc1b-932e-4178-9006-6a2499b8c348", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478921, "uuid": "de9dd047-d5f4-4054-9c15-40a6b09380e1", "value": "44674a17_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7166f52e-afcf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620459106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620459106, "uuid": "68ccabce-9632-4ed7-8bbf-5a736bc4b39f", "comment": "Malware payload (Formbook)", "value": "a464acd5b3a7def21690a99978d7bf42", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620459106, "uuid": "bf3ac0ef-1e6b-424e-8229-e502a565925f", "comment": "Malware payload (Formbook)", "value": "7bcbf4813256ce1a199f54f824f5e337a6ab4709287dcfa78f0cb24392e735a9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620459106, "uuid": "259b1969-8c02-47e6-8011-6f99982f99ed", "comment": "Malware payload (Formbook)", "value": "6b3b29a4675c4ce774c65f6b832fa0162e8dfb3b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620459106, "uuid": "390fea8a-b2e9-4922-b546-30a92c96715b", "comment": "Malware payload (Formbook)", "value": "368d39a5b2acfd98f9708441b133f5373be381f5f9c22370959c002b98ae951a05e18d380cfd1f84b0210f89a5437998", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620459106, "uuid": "acf3efb1-d2ea-474e-8528-026b339a1ca8", "value": "CC24128533C1D8DBEE7753715E3A675EE7AB4118226A020B6F290D997D331E3012F4E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620459106, "uuid": "53b2a03e-79f9-4418-9d19-b72f33b026fb", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620459106, "uuid": "a444007e-9dc2-4e1a-9a7a-88647bb0423a", "value": "6144:L9X0Gg7mFd2eK9yKU9slJmY8eM+NZGuswtCT3xKrsbhT:l0VSFd23F0UJ58eMz8tCjxT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620459106, "uuid": "a9b37df3-c52c-4471-b23f-e6a5f819e2d8", "value": 210423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620459106, "uuid": "837cdaa0-0668-42dd-b20b-157e0e00f1bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620459106, "uuid": "e317107b-1e8c-4362-91b1-d0ad3d4a674e", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880be259-b027-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620496939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496939, "uuid": "2d7e7d42-f6b3-42f0-a402-e3405e6b372d", "comment": "Malware payload", "value": "fef6a1ca7797ac6833de5bdb49f17c10", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496939, "uuid": "6cf8b941-91f4-4cb7-8413-376ddf9a04b7", "comment": "Malware payload", "value": "7bf750678ab5834bba278727bce90e0b719820601f888926da5ab1335fe2857f", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496939, "uuid": "76bdbf2c-8d89-4134-a84c-262fa3c6f2ed", "comment": "Malware payload", "value": "13a53cbc65e4fef639f3b31948b79e4913b9239b", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496939, "uuid": "2f90880f-d16d-4dfd-b028-d071286b5718", "comment": "Malware payload", "value": "67b6e0ea6f65cbfccef856e6d30c1d02a21055192ac951a6140ee947af5b70fd5609ac736f24e3ec9562f907faac0962", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496939, "uuid": "5bcf11a9-9a8f-4e23-80e7-05715fb0d9da", "value": "C783F15DD4BAFC57CC6A473AE29E0F8B585B19FBE5C13434BA50306E0B88E058B8D593", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496939, "uuid": "2043da02-3239-46e5-b57c-698d2a6182a0", "value": "1536:QXWpj4to9qS5VbmtwTPCGdnxlEZL4C+PvC8PCz5IuR2ZH7DuVrBJb5Kxc3:rwhoicPCUnwz8Ez5IuK7DuVQxc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620496939, "uuid": "6f3ffa45-4236-4a68-8407-64778b9c8c45", "value": 88556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620496939, "uuid": "cf79472e-2181-4d90-b121-fad37911f548", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496939, "uuid": "9821087e-76ff-4625-8151-b51ef2295bb6", "value": "scan of check 288206.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4834f60-b005-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482492, "uuid": "90b00a87-55cf-4b59-ab66-d3fd0678bcf4", "comment": "Malware payload (Dridex)", "value": "3a2c68c7604f596c89858cbce3ac0b16", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482492, "uuid": "6c560408-22fe-4fb4-aab5-fb8170b0af52", "comment": "Malware payload (Dridex)", "value": "7ca2e0914849b88071e510d76db8f933cb520e3b7ab8a097489e868dbdc8411c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482492, "uuid": "2c7327fc-24b1-41e5-9e1d-0d79bb142cd2", "comment": "Malware payload (Dridex)", "value": "f55c7c4f05754fdea4028ed808fea825b1f094ca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482492, "uuid": "411136fe-254e-4f78-972d-a83ece58b57d", "comment": "Malware payload (Dridex)", "value": "3faaab6afaff3225be61938bdc14bc93273a273850b8119fb63064593d5dd3c4d325b304f7be606f3db05a99ad32ee4d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482492, "uuid": "9d0461e2-9bac-4027-b073-7fbb10e84122", "value": "57F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482492, "uuid": "b14faaa1-0067-4b52-9234-089191f36ba1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482492, "uuid": "761ce28c-fdda-402d-b456-fc34c0b9917d", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482492, "uuid": "9483761f-0998-4046-868a-213fb5e8a260", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482492, "uuid": "e97a6ebc-824e-4264-8d93-3c2c5f484e02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482492, "uuid": "2a575970-db3a-40cd-a887-ceacc2e88135", "value": "3a2c68c7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd18a15-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432040, "uuid": "1296ae0c-9703-47e7-a166-2797c4ffbab2", "comment": "Malware payload (Dridex)", "value": "dbfac3d6fee3685b6dd04a64e384e787", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432040, "uuid": "7d7aca21-0e84-4938-b0f8-1e7c68985948", "comment": "Malware payload (Dridex)", "value": "7d835f866305d7f4fcefc334f28192e4ec97f410d9a29171a34e6593a76a2ee2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432040, "uuid": "90b90d8e-574c-4eb3-b1fc-86774f10c76a", "comment": "Malware payload (Dridex)", "value": "a6b4bb038199f089405e593638b880e04c974252", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432040, "uuid": "8afd417c-5f1a-449a-9b2b-4f836ba65ffc", "comment": "Malware payload (Dridex)", "value": "fb20e8a58a6d5551cdedc0839d4cd730798a86488ffd67af9f4ecefd4696f5c95b5b3056c272080c4f19387eab8f1345", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432040, "uuid": "75ff0c44-2182-4540-bfb9-c3c8f85eac8c", "value": "3EF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432040, "uuid": "f679d84f-f4a9-4b46-8b55-9a8996ffd00e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432040, "uuid": "2ea65898-846f-448d-a99f-23eb42abee9d", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432040, "uuid": "8f8a5e46-dbab-4b5b-8295-b9f44903fb36", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432040, "uuid": "47e380ef-e6bf-4b53-9d13-3e6fa0bd950a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432040, "uuid": "fdf81e55-5944-4467-9559-854588e34d62", "value": "dbfac3d6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff85d0e9-b03e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620507018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507018, "uuid": "91c3de73-86be-44ce-84e5-5b27cf11b74f", "comment": "Malware payload (RedLineStealer)", "value": "080e91f3bff2b54b14c79b22d423eeea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507018, "uuid": "8a4d3017-82c9-4aaa-b587-3e51cafd15cf", "comment": "Malware payload (RedLineStealer)", "value": "7efcf84512a68dc4df74df202f718c5251f8ccf1d07feb443ccd2c6735f57f90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507018, "uuid": "4e030c48-c8f0-43a2-b144-2dcedeabcf61", "comment": "Malware payload (RedLineStealer)", "value": "5b1e69bd7d48c50ed7719bdb778696cb2f694751", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507018, "uuid": "725354b5-c29a-4be9-833a-1effa168b148", "comment": "Malware payload (RedLineStealer)", "value": "10ac8437625236170cd3e34a03a53ee91103bcdf2f9ab9d6e565461e06a5e313afa64b0cb8e67a4d1d16ab7e1b194a9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507018, "uuid": "2ea14c60-5cd8-4c7d-8d6b-c47a2cb6a6ba", "value": "76C34B3C3BC8BE21CE6C6A7A84C2900583F69CE51662E37BEDC435D94862FE55913B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507018, "uuid": "38638a76-4000-468f-8cbd-3088737e18df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507018, "uuid": "e132fe38-1e0c-4562-a72d-87dab15d77fb", "value": "3072:aVuV38WYlKlm/72u+8JVG1i6StWy9BkWHyL1:VVL2iu+WVGI61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620507018, "uuid": "8348b91e-f66d-4e5b-84e8-28fdeb36994a", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620507018, "uuid": "a93e6c92-ba50-429b-af77-49d4d93111ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507018, "uuid": "ebfc931f-482a-4f7b-aefc-7a4039d5784d", "value": "080e91f3bff2b54b14c79b22d423eeea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af518dcb-b027-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620497005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497005, "uuid": "adeb6ce6-9a66-4fae-a798-27cac4149fc9", "comment": "Malware payload", "value": "f58905f781611a7abf7f10092e623111", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497005, "uuid": "334e5db5-a13a-464a-a5cb-2eb1cdcb679c", "comment": "Malware payload", "value": "7f2b4939a5016430c5b97bbf454192d8e55775937e0e7f331cc54463f60c583e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497005, "uuid": "51c6701f-a7ec-4bec-b8c9-8d859a2c1ee6", "comment": "Malware payload", "value": "66a21cabb67bc093577430bed55fee1621053ee0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497005, "uuid": "2fcf3dc5-8aca-4da0-bd68-322a2e6c4120", "comment": "Malware payload", "value": "74e3860f474ef325bf193f8157cc02b437b0193b1deadd6a835fc4c55acd718ccf63b6baa08ce0639ad488a0655bd766", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497005, "uuid": "f0a32cdd-0e02-4fa3-a644-cda8bcf89138", "value": "6FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497005, "uuid": "94ef7b4f-3e56-4c47-9bbb-642857f41b04", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497005, "uuid": "50fa80ca-7c2b-4c91-bd13-06d75d28dc0d", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620497005, "uuid": "2349d33c-3f70-415d-a0c6-7c105ab5f668", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620497005, "uuid": "c46c0a9c-32a4-4303-b68f-f60443b3a52a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497005, "uuid": "b86071c0-39a9-433e-b39b-00bd21749283", "value": "f58905f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f1cd85-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460865, "uuid": "31589542-d171-4b07-8eee-e8e6de405684", "comment": "Malware payload (Dridex)", "value": "c491e1b97f83b627556c638a9f7e9dc6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460865, "uuid": "29aa5615-c824-4527-8e0f-5937dcee4145", "comment": "Malware payload (Dridex)", "value": "7fca0c3a037e7588e84326990869ba2bb0be0ae408b5e791749bc37803926976", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460865, "uuid": "9f49ee4d-2630-4dee-a370-17abc2dfd4cd", "comment": "Malware payload (Dridex)", "value": "d5c7d469734839d0b57c0955c79a33ff16949ded", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460865, "uuid": "77aa61ec-9010-4970-8ddd-a7e249213d81", "comment": "Malware payload (Dridex)", "value": "6474997d63e9389146bccbb36bb033861eb5c6569adc96f48a588561b5c2d8328206fe0a7f8c90990df1a9e060408b48", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460865, "uuid": "38addf87-5c5c-4d52-b110-2072b5bc6663", "value": "B7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460865, "uuid": "0f1921cf-8f0a-408c-bfa0-f485a74e4ce2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460865, "uuid": "02bc87ee-ad4a-4fba-bbc5-da7200e8af79", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460865, "uuid": "dcfdd3f9-0984-4bf4-858a-1c981a193c7c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460865, "uuid": "3f750f85-2301-4356-848a-3547394800dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460865, "uuid": "6746b4eb-6d4c-4bb1-92a4-2003b3c15222", "value": "c491e1b9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2901327-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442867, "uuid": "5273fb23-7f24-4138-b70a-4dddb68a5fc6", "comment": "Malware payload (Dridex)", "value": "3c25e2f0df41be1caae86bfe6a2e2f97", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442867, "uuid": "bdcb28b3-4f51-4273-89cb-dadff1732455", "comment": "Malware payload (Dridex)", "value": "7fcf462d66d4e65e86e1d09cdd9da800c36158a672b1e9225dddefbe3579a8d3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442867, "uuid": "97b97a8c-b8d7-4ac3-81b0-51c2aca3ef35", "comment": "Malware payload (Dridex)", "value": "da6ea8036eb59dd4c23a895b2439340f54bdaba2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442867, "uuid": "01b8d1e0-076e-40b2-8eae-4f279ab2f654", "comment": "Malware payload (Dridex)", "value": "cbbcd2a4f946abefb523f67120fd4030c14a69a13069fd18a7f4b2dc05c027ec4ff5db53f52ae9bfb8c367e55c8ceed6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442867, "uuid": "55a80272-34ee-43ae-ac4d-efe844ca0b04", "value": "42F3C141C9C5CCF0CBE36C364695963B3628B941995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442867, "uuid": "c9315f61-5e8e-428a-adcb-2fb49ce88f11", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442867, "uuid": "8a4e4b5c-7679-4ff5-90c3-41ce2c1b4e15", "value": "3072:9uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+yX:90czbty9uiaJlnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442867, "uuid": "892794a1-7690-43ee-b7f1-4293a5316341", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442867, "uuid": "d0af53db-d6f2-4773-9aac-8607af271d68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442867, "uuid": "5152ef5a-71f6-4909-93ed-3efb581e700d", "value": "3c25e2f0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed12950-b005-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482536, "uuid": "77dce4da-7f9c-4dc5-85e5-72cb06f7e7a5", "comment": "Malware payload (Dridex)", "value": "a44ee6951de81598e7abd1059a8871c3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482536, "uuid": "93ccc1a4-997f-4a91-acfb-a75f35fb2578", "comment": "Malware payload (Dridex)", "value": "80aecd55d35cccafa5a28837c639c962b2ec3bddd1122db3d8fe3107b189a1d0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482536, "uuid": "c3ff328b-c74f-4c6e-8fe4-5dfc325bad60", "comment": "Malware payload (Dridex)", "value": "9a14fca6d2a29995ee218c74fb14bf71b17d17c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482536, "uuid": "40dd2ded-1520-460e-ac85-626c651aace3", "comment": "Malware payload (Dridex)", "value": "e520a11a178137df7a87da24ee3938d9008bb3b972b658ea664355a808fcde30b4746284dfcfb232bb5f74b2b990475e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482536, "uuid": "e5d03338-82a3-4e6b-8869-ad5c4ce944a7", "value": "9AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482536, "uuid": "fa3122cc-ec9e-4ea9-8dc3-5a612cd5f87b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482536, "uuid": "27add3b7-30d2-496a-ba62-f5806e0f6f8f", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482536, "uuid": "075b358a-f33f-4bc3-86d2-45ef6a3eb1c4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482536, "uuid": "143b039d-5dae-4dba-a920-d11ee5fa6da3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482536, "uuid": "bed8a1d6-70eb-4147-9df1-d89fdcb6eafc", "value": "a44ee695_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734d27a9-b032-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620501629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620501629, "uuid": "a8511a30-2195-4bf0-ba1e-c6f8e12bd106", "comment": "Malware payload (RedLineStealer)", "value": "4605efe4272e576db4da4e18e96614cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620501629, "uuid": "27602402-ca15-41d9-bf64-ba766e0ba5be", "comment": "Malware payload (RedLineStealer)", "value": "814bc1705b954e7f30bdca4ba236c2a19fad61f760073858acc2ac883597934d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620501629, "uuid": "d7f0e101-ca7c-4b62-b0b7-3aa390d2c9e0", "comment": "Malware payload (RedLineStealer)", "value": "96a0a9f8a2303e7fd3af1b67ba9ebfef09521e08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620501629, "uuid": "93328b19-6cf0-4995-ae51-0a621beb4d51", "comment": "Malware payload (RedLineStealer)", "value": "13440cc57bb0853284c74fd04c11541b4a5f6e9df5264bc524d831bf0b998b3674751b6e322492e435a1b3680bb18662", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620501629, "uuid": "1595e8d6-3156-401f-9248-d4b8d20722f4", "value": "0B14AE1135C1C1B3C4B7113044EACB799A7A7071177A92D7BBDD1BBA6E213E1A3362CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620501629, "uuid": "a1dacd66-1975-4de8-9a0e-fb7ed917424e", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620501629, "uuid": "047313f5-5f8f-4e36-9351-2514b2ff7070", "value": "3072:sDKW1LgppLRHMY0TBfJvjcTp5Xd0wHZe+Vl5RrCf+ewBg2:sDKW1Lgbdl0TBBvjc/d0wHdbReWfBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620501629, "uuid": "cef6428b-7686-44e6-9419-a5c8a814c3c5", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620501629, "uuid": "16b58eb9-2110-4984-96cd-b35a2fe236f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620501629, "uuid": "66ab3d2f-8d4b-4220-8fef-54d6bb46067e", "value": "4605efe4272e576db4da4e18e96614cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1d8c66-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432042, "uuid": "66f66d2c-c1bf-4d86-a34e-61efd0ae1a2e", "comment": "Malware payload (Dridex)", "value": "81614627c336ad84eac65150abffb2cf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432042, "uuid": "deed9502-36c7-459f-a6a2-18222ff8a43c", "comment": "Malware payload (Dridex)", "value": "83afdff43b9917a7abe322b64fe00b839232f1510f64801a438d6c424ecfb64a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432042, "uuid": "6bf2b738-33f4-4edd-90c5-c1cd8e6340e6", "comment": "Malware payload (Dridex)", "value": "e2b91c9955c6951fc3ba7b9c2b7c92a072362f64", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432042, "uuid": "61e30040-e96b-4bae-8f81-ce2c610feb8e", "comment": "Malware payload (Dridex)", "value": "739d6c334f4ff103d31597a16b4df398ca4962a16e5afbeda328313facac3b5bc3fa0520b07739101075655632a88889", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432042, "uuid": "c648bcf3-2382-4b27-9222-3e13e9020624", "value": "85F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432042, "uuid": "7e931996-d3d4-4f09-9f5d-cdcd041e977f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432042, "uuid": "3770f671-800d-4ae7-a712-d9620f45c51e", "value": "3072:2IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432042, "uuid": "f3f9da18-6f76-4594-9c5e-97e58b01fc5e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432042, "uuid": "e5d0d847-a53e-46ac-be15-8e80083b06ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432042, "uuid": "e687609a-4141-4b01-8458-356befa46404", "value": "81614627_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399b7c20-afb6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620448275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620448275, "uuid": "423e7282-d00d-47b8-8eab-4de28fb81fce", "comment": "Malware payload (Mirai)", "value": "133635e2c6bf235220855897aea3e3c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620448275, "uuid": "6b6e2c94-5c6f-4eef-b163-0e641c1f0cc3", "comment": "Malware payload (Mirai)", "value": "8400aedb11aee58dae33278137034e01f63443bf2f19c4975bb132c5453bdb72", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620448275, "uuid": "d0844fed-c3ed-49c0-ba01-8659be45c001", "comment": "Malware payload (Mirai)", "value": "48989e11cb4f281abf1141a887c57dcef301295c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620448275, "uuid": "dfb70ed1-bb9c-44c1-8ba1-2367752665a6", "comment": "Malware payload (Mirai)", "value": "5df481cdf0da63542eca1fba73c304111ca09ed4ae73506d6be2dd31b34f2136e0ed89412de4e2aaa982cba54959b39d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620448275, "uuid": "b6eea9ea-c709-4c36-be89-9551d3debe9a", "value": "6663F682BC80E616C7C01677FA6F509E331567D9E1EA33429D251BA07ACFC1B0D6B786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620448275, "uuid": "7fee15fa-48ab-4b54-ac32-2a061f1a9631", "value": "1536:BBnoU1QAu0Ud66g2aIax0lB8t46uxtaEJLoV:BBoU1QhX384BxtDJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620448275, "uuid": "85213950-4978-4750-8987-4ef6bd02390c", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620448275, "uuid": "1e77a9de-f2e8-4423-8ac1-495d5a17e6cd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620448275, "uuid": "6cfc4db9-73fd-4a7c-8b4d-20e6493cd997", "value": "KKveTTgaAAsecNNaaaa.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6e8096-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457326, "uuid": "eb5b7c87-8137-4e70-9f40-95954e52d365", "comment": "Malware payload (Dridex)", "value": "64a8fa17929f0441ba4b00055c079b23", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457326, "uuid": "5973a237-b9d0-4586-acaf-325f7578c76b", "comment": "Malware payload (Dridex)", "value": "84414edc0f6cf5b098162778564c197fa03bd7bf81ad3c613b54bdffb79a5c3f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457326, "uuid": "0a959d94-8831-4013-ab41-da7d469ae3f5", "comment": "Malware payload (Dridex)", "value": "3939e8c0198ec6b53daa51a2d433157ae45df4ab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457326, "uuid": "1b056cf5-657e-4c72-b347-97ae99c8f0e0", "comment": "Malware payload (Dridex)", "value": "6564efe5b85c2ba748f210e0b99b5b231647ca59ff514ee1b86471c9ef03ec0b7fdd08c01837eee88c4b6320ed8fcf2a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457326, "uuid": "5f501460-8a75-4c6c-9037-ed610e9899d5", "value": "E2F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457326, "uuid": "60ec29b2-48f1-4631-bfda-b518b37efc63", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457326, "uuid": "de2db58b-4a56-4ba0-89a6-726fe22aa9b9", "value": "3072:ue45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:z4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457326, "uuid": "3fdadaa5-dfc9-4137-8a20-2e401f400bd0", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457326, "uuid": "55f2ea5f-7ea9-428d-84ee-409b76edfaa2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457326, "uuid": "2b6c2c28-f17e-4b0d-b4a0-292e7a4e4aa1", "value": "64a8fa17_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55faeb09-b038-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620504157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504157, "uuid": "cfcc6eca-9ade-4558-98fc-39cff0ec402e", "comment": "Malware payload", "value": "479c3d58d0f8fba240fee5ebdbf05702", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504157, "uuid": "d3dda444-d7c8-4649-bc8d-a9e2bb6ea811", "comment": "Malware payload", "value": "856559efb9016cf6a6ad150bbdd0426b32b9fa3e651e0d2a96f3349678f1fd4e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504157, "uuid": "b52b726d-dd14-42bd-949c-5a73a253ce7b", "comment": "Malware payload", "value": "f65b2f41f38089cbee4c1e5e0a8bb8455e78aadc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504157, "uuid": "1f509b73-96ee-47ba-bdf6-17031abe1aba", "comment": "Malware payload", "value": "34c3af754d8cf85025618d35a58c22b6d07e406607fc73ed81dfef111a9f33f55821c3ae31ebb8a42acee600161c23a0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504157, "uuid": "89b20b70-7da8-4f06-9cac-beded8d59d28", "value": "05F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504157, "uuid": "b354c3e2-0b7b-4a71-99a2-8700a0009eee", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504157, "uuid": "bc10749e-eca2-4a64-afc5-bfe36e5bb57b", "value": "3072:qiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:peAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620504157, "uuid": "e00eb0e7-263c-4253-b17c-71ece5bcbcae", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620504157, "uuid": "8cb2fb1d-ba53-4837-9c5e-02e73766ddaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504157, "uuid": "24638a94-8e6a-45b2-8e48-1c2b5ca277eb", "value": "479c3d58_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75f17b6-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471678, "uuid": "074b98cf-fd6a-4d4d-8dcb-42bc9f342a3e", "comment": "Malware payload (Dridex)", "value": "9d82dce73a1b69c56e8825fc52f7e5b7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471678, "uuid": "a9e3d3ac-3d3e-4e38-98c1-859ecee206a8", "comment": "Malware payload (Dridex)", "value": "857dddb79c682fcf901e3f87e54ec8347edd48872482dade7f4124d8ae7ae4c8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471678, "uuid": "36789e26-f2ac-44e8-8fa2-c182e30a8534", "comment": "Malware payload (Dridex)", "value": "d19ee8485af46a71eb067d008dbf9eea399179d6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471678, "uuid": "cdfd88c6-e52d-4fdf-af4f-84e6fcf2a5ec", "comment": "Malware payload (Dridex)", "value": "51d3ed6c0ad493cbf107819eea1f0217d949996afc2e09784130e592d0d03a1d95a2fcdf6b1fd399c57c27e2c45adab1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471678, "uuid": "90f8c719-070b-4495-8325-dd977ce7e456", "value": "1DF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471678, "uuid": "8793a193-2a0d-4e9d-9425-bbc8a0554bae", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471678, "uuid": "ef755f5f-6ece-4c63-a080-486c663dc377", "value": "3072:Je45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:44KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471678, "uuid": "1cf68ab5-cf43-4c65-97f1-4b119686c5e3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471678, "uuid": "515cd6d7-8b19-4a83-9fca-bd064c7be58f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471678, "uuid": "2480d1be-affc-4a33-a97b-f194680c5a44", "value": "9d82dce7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9b16e2-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468093, "uuid": "2e8ba4d9-4faa-4204-8782-47cf0755680c", "comment": "Malware payload (Dridex)", "value": "a37966c8313a06f6aabff807f77cd075", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468093, "uuid": "a6dcdb5b-2db0-492d-866f-d5dc7fdb8518", "comment": "Malware payload (Dridex)", "value": "85936c996379436e44c58be69e9cc2c31edebdc191abfe12c1a53011e549350c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468093, "uuid": "d7eeb739-7a37-4ecc-9049-4c8858d1354a", "comment": "Malware payload (Dridex)", "value": "53bd8eee955ae970936b0e60b099b4ef00db8ee9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468093, "uuid": "ba3e591a-a7cf-42bf-bf1e-ba4e32e8b0f6", "comment": "Malware payload (Dridex)", "value": "663ab6230caf389cccdeb158824ffb7fee5dfa9dba0d4436c935e84be4030634e5ab3481419ec17f47b3e02a35467523", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468093, "uuid": "ae60be51-faa7-4390-8c45-ef025963473c", "value": "38F3C085DBABE87FC44A35399471DFFB5B388B149640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468093, "uuid": "b1b2c7a1-e923-4f9a-98b6-2c564af35f99", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468093, "uuid": "383685ea-deac-419c-a153-9212f68d537c", "value": "3072:1e45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:s4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468093, "uuid": "3a41db4b-9ba9-4161-9e20-8b98aa572a8c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468093, "uuid": "ab4491da-c3cd-4919-a7de-b39aeb581f2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468093, "uuid": "c10c093b-3a48-40c3-96f9-8a76b0ca0dda", "value": "a37966c8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c74acb9-afb5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620447957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447957, "uuid": "eb33c076-707a-4864-93c9-902e0be33b32", "comment": "Malware payload (Mirai)", "value": "a3f9cecfc860c9729fa8fa5c43c8ab8c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447957, "uuid": "191563d0-3c9e-4569-ab9d-5b5747146324", "comment": "Malware payload (Mirai)", "value": "8694ecfd3ab3ee2e1dc0b05ea3c0ad9a043e0d08d16a7afeafc3de0c4863df3e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447957, "uuid": "459783e4-04d2-46be-b457-a1aa1371868b", "comment": "Malware payload (Mirai)", "value": "559bd889f83bdb99019228c329364fc934209a3a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447957, "uuid": "5b0f4ab1-1536-41eb-8ec6-3274a707a325", "comment": "Malware payload (Mirai)", "value": "b3e6d53ac5f33822c6399f485ca19f4a3ab33a0f577470b3427b3210f63d6461f9fd562fb1d1ce1d8589678ca9cac88d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447957, "uuid": "d206c6a3-eff8-4c8b-9642-c36edc076117", "value": "91E2F1F345CAFAA0F4B9803A67973C49A810173EB588286CFFEC901A6C52D1D3D95392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447957, "uuid": "a60cbfe4-7483-46d1-9bce-b694de3dffdf", "value": "768:9MFtLMTUNlY4NiAsbHirdlMkj520TdHN8gqp9nbcuyD7Uryqc:9MFtLMTUNYfiZl7j5XTdHNInouy8mqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620447957, "uuid": "fddf732f-232b-4f40-9726-d2566476f10a", "value": 33672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620447957, "uuid": "fce950cb-d438-4e7f-a17a-f57cd5aaedcc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447957, "uuid": "13ea49d5-bf2b-4a40-8281-16f7f599c88c", "value": "I686(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed08e61-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620471691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471691, "uuid": "7ca26add-ee43-4d3c-849e-045f0af52f32", "comment": "Malware payload", "value": "0650931a4b936b63ccfb5082273ef543", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471691, "uuid": "49b3861c-dc86-479e-9d95-96142cd314c8", "comment": "Malware payload", "value": "86b4c5e321b572852a31e491bddd34a9ab120aeb4908288f05150d0791283c71", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471691, "uuid": "29a108db-ae1e-4444-9c66-83b2dff816c4", "comment": "Malware payload", "value": "4ca7a4610c03cd93d1538a0a9178866d0bf60902", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471691, "uuid": "9cf57844-c7a9-4a17-9fed-454661e3baef", "comment": "Malware payload", "value": "f3f540dce5299d3941220ebfec9e316eec1d8312be20fdcf25a22d4df24e9c510ba24bcabf7c5c970281d8fbc016ce0e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471691, "uuid": "48b2ca87-47c2-4ca1-b32c-a60da80dabda", "value": "EBF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471691, "uuid": "79c61fab-bd6b-42fa-812e-2056638ba60c", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471691, "uuid": "fffcd6a5-1d64-41bf-9d9f-aca2ee19ddeb", "value": "3072:AiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:reAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471691, "uuid": "5a48de53-0db2-4c5e-a0a4-957409f11a3b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471691, "uuid": "bf34f07a-8906-44cf-963f-de7c611600ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471691, "uuid": "a743a5a8-3dc3-4f6d-b46b-746f0df755d4", "value": "0650931a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5389f40a-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457337, "uuid": "7ef3c166-9fec-4484-aef5-00175dd9f991", "comment": "Malware payload (Dridex)", "value": "c2075ec8d81bc9e20af487c97eeccbb5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457337, "uuid": "78dbf931-9054-4603-bde2-87c903bcccb8", "comment": "Malware payload (Dridex)", "value": "86ec010f0cbd56ddd75e9b6289eba8c84db9ccfd13d509bd022758e343665c9c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457337, "uuid": "4845fa6a-ca7a-4040-934a-1f9e7ddc20b9", "comment": "Malware payload (Dridex)", "value": "61267cff47f78811e612c383e9cef777125db530", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457337, "uuid": "1f98db97-ac6e-4fc5-9b40-4b03214f3a07", "comment": "Malware payload (Dridex)", "value": "211eca9e16870385f15020890a4723ecd0c9047d7bfee613f9a7f15a6f23d84e69c61300e850091f766b36040f81fd8a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457337, "uuid": "68023d38-13a9-4b16-883e-a71d5c5479e3", "value": "BDF3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457337, "uuid": "09577efb-c2c0-4b69-82db-0fd7d9094ce6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457337, "uuid": "d394df05-ed43-4971-94c6-be2931b75104", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457337, "uuid": "8cebd06e-9420-4a42-a49f-b8c101ee2d41", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457337, "uuid": "ad6841c0-70c2-439a-b7e0-928aff2accb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457337, "uuid": "f84a3864-9d30-4898-a678-f8eaa1b60c2c", "value": "c2075ec8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449e7b38-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457312, "uuid": "4c5283e7-ee8e-4434-b8e7-d65e34080976", "comment": "Malware payload (Dridex)", "value": "3af97217eecf142af9a89f20f0b49765", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457312, "uuid": "95ad7fc3-6a88-4bfb-b1ca-e78490c076ef", "comment": "Malware payload (Dridex)", "value": "8848a70d97a492b40d8202342ed7c56a02da3ed8f7ad572b0271d05cb3e22644", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457312, "uuid": "6b88cf86-22d5-4e56-bea4-8af9f2ff6c6b", "comment": "Malware payload (Dridex)", "value": "d86ed39e30dece59650689fd3de97a43e1dce727", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457312, "uuid": "ee693106-39fd-4a0a-bc4d-e16f7982abdb", "comment": "Malware payload (Dridex)", "value": "d9f5f5249d5f95295f79abd494d7f6fe607911dcb76f01d740d6e5117f669a64ef2597a7c395452b380e3077300706db", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457312, "uuid": "48f77837-0d80-4057-873e-8e8d25652bba", "value": "66F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457312, "uuid": "9ba5bca0-5061-41e2-8406-cc6879bd2a78", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457312, "uuid": "a4fcba9c-051f-48a5-a840-c6dca50ef948", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457312, "uuid": "e62b5189-f8fa-4404-a8c4-f58c5f892334", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457312, "uuid": "900ee1a7-5062-42b4-a630-e531aa1c3dc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457312, "uuid": "fa4804b3-89ba-4526-af8b-a59ed3d8fe68", "value": "3af97217_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580a249a-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "90b2a6de-c262-4763-a901-93ce94558eef", "comment": "Malware payload (Mirai)", "value": "d3662dcc74e3a86b02c556ff81d86631", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "cd805b60-c9ef-4507-a344-cd68d7184799", "comment": "Malware payload (Mirai)", "value": "8861a26cc96cb1eaa4b32c1987d3c1a9384bbba638faa1a871515e88720795fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "cd27c694-e2e2-40b2-b133-ee90f543d031", "comment": "Malware payload (Mirai)", "value": "e7483bb8652bd4d2b555acad6a9624433bff0161", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "8d396ba9-029c-4e6f-a3bf-482ac1bedef5", "comment": "Malware payload (Mirai)", "value": "964e0f0de6bc7440dcc09c5c42c108646a8e9fd7e700a9f8b76d96f57a2f6b52402e84072ef5be2cf26eb499a83865b9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "7648f53a-2326-4885-9283-54f067d7ecdb", "value": "BFE2E136C3485E8AF7B56F28FC2CEAD12BF84A4C60D9EB439194CD121257E935B14ED1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "4ebddb85-cfaf-4264-859a-6fcd83bae602", "value": "768:dF1Gqu47YfhbsHE6O9xjuCNsSTEIg5x4uVcqgw09i:vYqzAbsHER9xH/Trg34u+qgw09i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475384, "uuid": "79e5ec5f-8671-4f2d-8358-e4b8516d37d9", "value": 32444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475384, "uuid": "dfad51fe-44f6-4c84-ba97-78034e7c9bbd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "e8471c06-9025-4fe3-8050-5a2e493a5cc3", "value": "xd.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09081099-afdc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464514, "uuid": "850a2df3-05a2-4e85-8987-cd569e5c482d", "comment": "Malware payload (Dridex)", "value": "7de90c9b9ccc21ef1574dd9b9765f57f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464514, "uuid": "6f8d9968-0d63-47b3-97d7-c6ead14c951f", "comment": "Malware payload (Dridex)", "value": "88ae3814881772d94e454f6eaa3d80ef459433b3fbba1a6ab2f9c07e124424af", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464514, "uuid": "57aa9b3c-f146-4230-a229-d52bc861d157", "comment": "Malware payload (Dridex)", "value": "ca2e9cc87ea4719d6eefa748061a5db47b29e231", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464514, "uuid": "8410e94a-9bd5-4f7c-a23b-753827df8423", "comment": "Malware payload (Dridex)", "value": "5a594f956034cbbaf744df0b52ee49263d4d3f83a063c960e4c18ecab2f515597c8314bcc2ad03ab3dafcef89a979510", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464514, "uuid": "6ad44f5d-ba76-4139-a128-a1d7699e2d1c", "value": "19F3C141C9C5CCF0CBE36C364695963B3628B941995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464514, "uuid": "9c4a199c-4fa6-4706-8db5-b6c3ac27ed97", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464514, "uuid": "3616384a-9354-41af-bd22-a051b9b2513e", "value": "3072:9uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+yX:90czbty9uiaJlnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464514, "uuid": "8b2e62c3-d0f6-4fd8-8f6f-7b62f497b3e3", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464514, "uuid": "494639f5-8a01-4e14-bd5f-cec565bb7246", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464514, "uuid": "a5517024-849d-4852-90ef-8d7ca9539ca8", "value": "7de90c9b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c5c86e-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "6dd87fd5-fb28-455a-b783-aef1fd0496f9", "comment": "Malware payload (Mirai)", "value": "2fc577ca286332394c863084d515d874", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "962042a1-a6be-4110-a5a4-66c5eeb154ef", "comment": "Malware payload (Mirai)", "value": "88b7ddf978d1fafe0475959f7e1fda9f2c0229853b4efbcacef5c1aeb82398d0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "d5a28aa6-2d27-4c41-8a84-62569f4fa8f1", "comment": "Malware payload (Mirai)", "value": "7ed14fcf0d03b443e83411e15958ecc79ce42062", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "97c33f6c-4d34-45a6-a96f-00ce8c693af4", "comment": "Malware payload (Mirai)", "value": "0178df3150c321ad2521b49d8770b10672f71a1a142c7af9cba83afe5f77394a031e55d70bcf72db1e140354c4bc1fde", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "786b91d7-7d38-44fd-a261-38dc486213ef", "value": "77132BC8A943DDF4EC1506B02136EB36BBB7F13A213DE997C75BD523A842601E50729E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "2b704e2d-d73d-4216-bd97-ed0989b630c9", "value": "768:V3oIUEpco3wHrnBcRnLgAkCqGd1w0/OJku/8DmWv8CFQDmjn0I/u8jV+I5E8fVL:V3oIUEpco3wHrnBcRLgAkCqi17WJku/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475383, "uuid": "c0e7afbc-19f7-47f3-af9b-64c09c7e8714", "value": 42588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475383, "uuid": "9dc66d24-0715-4909-9d47-d41307976f49", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "195216d8-272a-424e-9962-7a425391854e", "value": "Winbox.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eefbdb0-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475369, "uuid": "0c138ef4-fcaa-4a5e-9a92-137be3fd49bf", "comment": "Malware payload (Mirai)", "value": "05d9b2a6d57c793574631b63c7b1430f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475369, "uuid": "af201256-843a-4813-bd18-5300208a9fc0", "comment": "Malware payload (Mirai)", "value": "8a0c455e4311c38111d3cadfac0ef2c49a251bc85cf70cede59ebd030057c122", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475369, "uuid": "e91a7377-89d0-48a7-a098-c8a898b776cc", "comment": "Malware payload (Mirai)", "value": "ec9bcb81d31d1ccb381f41d656e31f643e09bc6b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475369, "uuid": "d57443c0-3826-46c8-b810-a53e6cfe9662", "comment": "Malware payload (Mirai)", "value": "0631f0d96ecd87035010cc7ca3494bd32620c501610532fdc8f19ca73454edb091ab8cc20cd4602fb294f2c269f0314a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475369, "uuid": "442d4fe3-58d7-4306-98b3-feac360fa59a", "value": "F5539EA5C4AC9D98C6264678F614C839AB23A00C62A33DF6DA57C656841FDFCF01C7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475369, "uuid": "5c7ca462-7c7e-46a4-929b-1dfb122f7b0b", "value": "1536:K/ue90IlCalyZyuhx+vACs2U/SO/Sfs3zO/QSwtPlCXai:KGejAGyZyuhxaU/Sjf+iYdtPlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475369, "uuid": "6283a62e-87c5-48b6-8e54-585afb1ccfea", "value": 66368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475369, "uuid": "7c878ec0-5d6f-4188-93a6-9b1c7155c2b6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475369, "uuid": "e64a6013-7777-409a-822d-9ccc70d066e9", "value": "loligang.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64501a8d-afba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620450064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450064, "uuid": "cb023b97-c1a7-4a40-a5a7-f44a892b0aa6", "comment": "Malware payload (Dridex)", "value": "1a08727b0e1c3ba6e716c8a0cf12c9ec", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450064, "uuid": "057793cc-9f5b-4406-af3a-d91198d2d5de", "comment": "Malware payload (Dridex)", "value": "8a0dd3db48df9c175567d7423e88c8e44c8fe5bff462f723c4f0018a92f8ca4a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450064, "uuid": "a7c55588-c910-43db-b4a8-9136cc3e16cc", "comment": "Malware payload (Dridex)", "value": "45e727670fceaff64d6a84920270f16500ab5680", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450064, "uuid": "7505f56f-0e56-4ac4-8497-70747d4cbab9", "comment": "Malware payload (Dridex)", "value": "86575b8ffee72401e375d6189b1f8050ddb498e44717a1c4f5efa4fa1f35d2d2576d65854311e90ba1ac506e7c5e8a23", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450064, "uuid": "e1386e48-eb2b-433f-934b-8141d6711468", "value": "74F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450064, "uuid": "13d85f07-a9dd-48dc-a657-cee37e8e768c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450064, "uuid": "2bcb2c18-df17-4c3d-ae85-81dcdd9685e1", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620450064, "uuid": "0ad3f773-8715-4e6b-9988-5ffb563d8168", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620450064, "uuid": "5c3384f3-59f9-4f65-9262-aa8e7b6b61c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450064, "uuid": "960686b9-1af3-4c5c-854f-21c71a1f1278", "value": "1a08727b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd20a5e-afd7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620462455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462455, "uuid": "1d8f9561-7303-4b1a-a988-80589746f26f", "comment": "Malware payload (Formbook)", "value": "7ceac88b29ab061f0fc1f9915006060f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462455, "uuid": "cd74577a-d736-477a-831b-8757c40b842d", "comment": "Malware payload (Formbook)", "value": "8a116bfcbc1c440c1491513ee9efde46fe7f2e7f24fcdb3f43ee21d0917face7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462455, "uuid": "45c5c6a9-6a9b-4b57-9ede-fa10552733e4", "comment": "Malware payload (Formbook)", "value": "b7cceb6c9e8c50cda1b6f8643f2d123ca100d8b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462455, "uuid": "37efa16f-dfa2-40cc-948e-f408ef8126c3", "comment": "Malware payload (Formbook)", "value": "477b1c5ef4b887876936389c8991600c883114912da5c51fbaec162514c7b301203ffccf20e56f91fde3702aac73f6e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462455, "uuid": "5103ca06-49e8-4615-ab90-0d79af696c53", "value": "D105F03653946B55E1BEA7798934E22013F2BC45E772CA0EBEE534DF2473B814A76302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462455, "uuid": "2e287a7b-dd34-46ae-a31b-935e6d4926c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462455, "uuid": "d3f484f3-538b-41a3-88e9-4c733c0c99b8", "value": "24576:tT7OnYMImOwwilE1IBQv5GRPX/PJc8uqeyUkUx:57OnYvmOai+CoMfkUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620462455, "uuid": "01b874c3-ca65-4d96-931f-497dcca12e91", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620462455, "uuid": "599cb9d1-9688-4fcf-b8d1-0cff1a0d214f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462455, "uuid": "36ddfb1f-b2de-4296-aebf-cff08805a3fd", "value": "NEW_ORDERS 122020 2 x 40 HQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55834cd0-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "83f64c79-3ed5-482f-82a2-db520f7edc4d", "comment": "Malware payload (Mirai)", "value": "55a52341ad9e2225c310dca7b150753a", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "35c4ec26-9aa4-431b-993c-f4fadeb7debc", "comment": "Malware payload (Mirai)", "value": "8a21608e2462f51f41408a790faf43444b6aff9b1e026613550d5a0615fd0855", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "929ae6a5-040a-4e0a-b64a-2df226d83abd", "comment": "Malware payload (Mirai)", "value": "d0833d70728005d6c2d1c8d4e708fb056e744167", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "29fd6099-f93d-412f-b8e1-0a21f1ecbbec", "comment": "Malware payload (Mirai)", "value": "a9c9532d25d3f1cc56c4b525789b3586b5d3e75ac2f476f4e38113f0f0309803c40939f9c2449a3fe08371fa09a4d0a6", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "d8b4ae6c-ea46-4d18-9902-a5a42b293d76", "value": "546319817C80AA26C7D0177BFA9F108E3314ABD8E1DB73478C141F95769A81F0D6BB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "367f24e6-c795-4605-ac51-785355b8bcbe", "value": "1536:GbtexU5L9XouIRhb96pUQzXtwavaJ3V8OHxouJeZWDFI8UM:GbtexU0r8QCKw2Fbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475380, "uuid": "3910de1e-bf90-4dbd-80e3-8f1437a86a97", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475380, "uuid": "661b7a3f-20d1-4c26-8ac0-1e02e00532a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "0d749058-bc0e-4698-8965-f2e32a6c5216", "value": "loligang.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e195fcd-afba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620450054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450054, "uuid": "0763cebe-d4a9-4b98-b344-374d8b8c495e", "comment": "Malware payload (Dridex)", "value": "efe252b84f355230c23132fd8f4c9daa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450054, "uuid": "9645ddb5-db2c-4130-add6-23389b0f375d", "comment": "Malware payload (Dridex)", "value": "8b2683b43c72723ee8bc295b1a78ad87a335ff1b4ea3de2b4ce6245e9c2f4c77", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450054, "uuid": "dd1e431a-fdec-48ba-8441-9c4885420f81", "comment": "Malware payload (Dridex)", "value": "c42b9efe06938e6641327166ef129c391fc9a1b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450054, "uuid": "93716ed1-88a8-4a37-a5fe-f5631f62d0ef", "comment": "Malware payload (Dridex)", "value": "81acc536c9ec4c332450b174889d17fbd82c92868a01f3de58e351afb40fda2b603106845b163d5442f08c7abb32630f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450054, "uuid": "2b124455-c6c4-45e2-8af5-0a922f410316", "value": "D0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450054, "uuid": "ed5a02c4-5206-43c7-b2f5-1c52d183cb15", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450054, "uuid": "ffa3c4b6-dc39-4a9b-975d-21ac91125dd1", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620450054, "uuid": "cf2e0913-6710-4808-93fb-01cc38ab3f9b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620450054, "uuid": "477ac379-b833-48d0-bef8-603325b86ce9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450054, "uuid": "d11b568e-d8e9-42f8-a974-d0e040af8ad9", "value": "efe252b8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ad6c13-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435673, "uuid": "5a5c4efb-563f-4815-b963-8bbd4085b936", "comment": "Malware payload (Dridex)", "value": "866336e04ed63bcf0c1d9e7e3c723c0b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435673, "uuid": "8f7e5960-27df-4799-8f41-71ed81fba71b", "comment": "Malware payload (Dridex)", "value": "8b324ff59b4d8a8301027f820d0a5c8f93f8886523b1b903b461f7e6e4931892", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435673, "uuid": "a44c7db2-798d-4a49-9dc0-2002dcd06ab9", "comment": "Malware payload (Dridex)", "value": "b5f412a881d8ec012add847a5a81b79739d8d0cc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435673, "uuid": "b091afb1-cf57-423c-939a-51d29eb01909", "comment": "Malware payload (Dridex)", "value": "9309867e0eb78323ae48890325245ce09cc504a62a0588ffa9537a2b955c560b023d42d53c374be50aadea52fff6ba16", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435673, "uuid": "d53085eb-356f-4a37-9f3d-ed9f5869f37f", "value": "5CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435673, "uuid": "74c5ee8d-7e3f-4b66-8404-00ad839563de", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435673, "uuid": "b7c43159-39ca-4ba6-9418-64f4e33b4799", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435673, "uuid": "a014fccd-b8f9-4051-a25a-9c7fe49361ed", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435673, "uuid": "392b6dd7-88f5-44fb-9d80-991d8668e1e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435673, "uuid": "46a9d105-98d2-43c9-bc3d-16f58ccbda6b", "value": "866336e0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33428d9-afa7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620442009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442009, "uuid": "0eaffa78-7e80-4908-83e7-afbfb572a543", "comment": "Malware payload", "value": "240c73004229183bda7377e68d714c75", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442009, "uuid": "3418225b-b421-4863-9d51-1b92fb231667", "comment": "Malware payload", "value": "8be3fbc8b2a2136ac4d7b35d721a5ec6847161a8e6b4137a0c11a8594603c0df", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442009, "uuid": "3cfdcb00-2517-44db-b76d-fb10e945ff90", "comment": "Malware payload", "value": "952c60daad92a603e0e314c8ba13384fe9bdd8be", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442009, "uuid": "5973370a-e985-48a5-a251-31a3b928b8fb", "comment": "Malware payload", "value": "dac5c8dc12fd9d719de6133d7274e099881afd841c890036e55ad3571cdea494685d56068b59929d05d09453dee071b1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442009, "uuid": "ce1f379f-e0a5-4275-a8be-5f2de89ba973", "value": "7A7130332FB3E872C7240F7B02EB19EA36585760070444DE0B9B291E2D198EFE52CB56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442009, "uuid": "acef4d0b-3b4d-432d-a644-fad2faf984a9", "value": "13ae18cd70fe91312dd8206f2d86742f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442009, "uuid": "72fa3729-0e07-4751-8094-b70fc09c3762", "value": "24:eFGScwQtb10Yyn2XgupDW+YPvJRQDETRQDzRXlkUla52XIdy/0vC:iST0YhwulW+Y3JRQgTRQXRe8K2YYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442009, "uuid": "2c27f112-a84d-4c3b-ac72-ece4059b1000", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442009, "uuid": "b81daa84-cf35-48b0-bae4-4ccbdab15036", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442009, "uuid": "b1bc2e7f-3408-48be-a304-cda3bcb7fe16", "value": "SecuriteInfo.com.Variant.Jaik.45760.14619.11104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab343960-afbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620451472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451472, "uuid": "33b4ae95-6f39-4527-801c-e9271ee04ed9", "comment": "Malware payload (AgentTesla)", "value": "b1b481f73161a2306815df887dc32f03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451472, "uuid": "b8eb3e43-7af2-4051-b185-87ee6e901d40", "comment": "Malware payload (AgentTesla)", "value": "8bf61f9efba8f27282e3bb4d0e3661260ce5c265c27630878b64aa138a1adc68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451472, "uuid": "2095d3e8-7990-4e49-b3bf-3a4fd371e084", "comment": "Malware payload (AgentTesla)", "value": "ddbf7d730eb0c04e5528754efd5c8b3af2899051", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451472, "uuid": "f5ce90b7-f04b-423d-9ae6-5bfba50ad1a1", "comment": "Malware payload (AgentTesla)", "value": "d5a8726c10ccbfdebfa539318e3c85a7c6227d46d0c774a3faed8605a4aaa927a3132b1639a4008d3886c593ae9a761b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451472, "uuid": "86d4d32d-fb5c-4418-9590-b4f94d2a48ad", "value": "95A42354098B8CB2AA059680DF6535BE254C87C81D137F6E856747FA2CE231B93375B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451472, "uuid": "a066958b-859f-4564-930c-d7650b982857", "value": "12288:uzihBug6f5WnGDeCwKOHBeOiFpWZ3n4rXJkGUIl6szGP:uzwuH5WRCwKxOiXWK9sMzGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620451472, "uuid": "bb79b105-4458-4fee-94ca-7574260dcdc0", "value": 482735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620451472, "uuid": "24032622-adc6-469d-bc85-dfcdda56b593", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451472, "uuid": "0e993e34-77b2-43b7-92f4-734090941ba3", "value": "NEW ORDER #745332.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83dae10f-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478893, "uuid": "908f279e-afd0-481a-b50e-2652eaa51b8b", "comment": "Malware payload (Dridex)", "value": "376d0ac14234de9ef2434772b8fb20f6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478893, "uuid": "218fd1da-0d7e-4baf-8e8a-0d1a53d10aa8", "comment": "Malware payload (Dridex)", "value": "8bfac5c5450227e73e5eb5de2e63bb41b6967ff628fa5a034d616317b9e3aebe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478893, "uuid": "aa24064b-7635-470c-ad2f-c6031d180d53", "comment": "Malware payload (Dridex)", "value": "87191afaeeda91b60132f1d93380d7990670ea68", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478893, "uuid": "da441bb4-64be-4a56-a2f0-f8a3637636b6", "comment": "Malware payload (Dridex)", "value": "07fe6316c534880b4d9e569e626d1a709b2f046748a2b3f44d34f9a35ef18cc8a83985b4d31a0b64b17105ba8316c15a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478893, "uuid": "d4e423e2-9a42-43ad-b179-f6df57b16af6", "value": "0BF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478893, "uuid": "fa46d293-a751-405b-afaa-34c3376e3503", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478893, "uuid": "5f73f3ba-93b7-463e-8745-4c9dfce3b4ef", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478893, "uuid": "cb5722a5-a08d-4756-8e3e-d4a8decfdefe", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478893, "uuid": "ed3ebf89-090e-4042-9de0-71a6c147f93d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478893, "uuid": "5343f2c7-4c4b-4426-9583-cc3afad7c91f", "value": "376d0ac1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a752244-b02a-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620498017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620498017, "uuid": "3bcfdd00-4b6b-423d-8b74-61da84e461a6", "comment": "Malware payload (RemcosRAT)", "value": "a71cd5886cca33a25f832a1ed37bc4af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620498017, "uuid": "30f78deb-ef74-4ca5-b7bf-99b65f0df426", "comment": "Malware payload (RemcosRAT)", "value": "8c5b2aa9fc23e7e50d09bb41c9729efd821e6094a0477a65054ff20938723d88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620498017, "uuid": "b3bd8871-55f6-4d33-8b26-9a2fe0a98fb9", "comment": "Malware payload (RemcosRAT)", "value": "7bacf2f5f80c03a298528106a34db71951a1e94e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620498017, "uuid": "d8eae569-c760-4970-8145-cb534f910c1f", "comment": "Malware payload (RemcosRAT)", "value": "5a779c1430e233a5b0d2ab58369560e77adef46e43fbfc3e9f9b8685f3d527de0f58e3a0b5a52d1bce87c7157b567a34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620498017, "uuid": "c315d6c7-02f5-4e58-a15a-0a3711d116f4", "value": "A715096832A81BD1F27B6FB663DA1C0183B92574653ED50D8FA113FE4963F031A35A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620498017, "uuid": "0fea5203-f0a4-4af6-a54b-b608cd1b95bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620498017, "uuid": "2063a9ec-c4b8-43b6-9ed9-1e49a3c5c458", "value": "12288:Tj+bB4fWXY3Ot6InK1sLuNp+dM0kKg0D75wAPG+zETi/Pih2CV5R2DMaQ9wLcmFy:nD9wLPStoLA56ZK+ExLfBDWAzu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620498017, "uuid": "983ed690-7c3f-4537-89f0-05735dd4371c", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620498017, "uuid": "daa0dae1-eb01-47b9-a01f-2b988645f995", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620498017, "uuid": "ee892fba-a328-4e7d-acfa-c66d33a39e60", "value": "a71cd5886cca33a25f832a1ed37bc4af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fee79c5-afb6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620448285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620448285, "uuid": "0bf320ce-ea98-40c1-86ba-51c3f8f4207c", "comment": "Malware payload (Mirai)", "value": "18aa1324041f791a0614f8178eec0f2b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620448285, "uuid": "365ca11f-4138-41a1-a532-7263176eac85", "comment": "Malware payload (Mirai)", "value": "8ce58811fd855ec03cc1c05932978a6881aefeae9783f4042141d2ee23ff44af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620448285, "uuid": "e01dbe8a-1b88-4665-b73d-d73963f602d7", "comment": "Malware payload (Mirai)", "value": "716b8ee65d7057bccac1b9e58ebb8d43610d968f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620448285, "uuid": "1d2eb563-602f-42fa-9ee1-5c873844633c", "comment": "Malware payload (Mirai)", "value": "75cb05b0b825993e68540a6fddaa530f52eb03ce90770d5f4bba4ede78cccfcd4f6557a4a38f06c0e997914a3dd9343c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620448285, "uuid": "17181901-04ad-4d08-91d0-1158deb72d6d", "value": "4F53F682BC50A629C7C04777EE6F509E3311A7DDD0EA3742DC250BA47A8AD0F4D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620448285, "uuid": "6e3a8286-14a2-420f-ad2d-b1c638c7453e", "value": "768:mjy0IB/1vhcZ4f5i0Gnr7O2xrV4+mNZM/o1Ccy0uiDz701T1fj7NSqtUut65aQ8u:5LB/ThflGnnRxrmTMtcB8t46DmkZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620448285, "uuid": "c0bcceb9-150a-494c-9819-6c330649c5e1", "value": 61200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620448285, "uuid": "06cb9acc-08a5-4d22-a831-38df44786ce2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620448285, "uuid": "b4f98496-7c85-4358-9186-7583fd090fa4", "value": "KKveTTgaAAsecNNaaaa.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d04f51b-afba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620450079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450079, "uuid": "4b32374b-8811-41c3-ab18-211f4553c5a9", "comment": "Malware payload (Dridex)", "value": "d183f42de805f24a4db69bfd1a186d91", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450079, "uuid": "b5e3cf5c-44db-4751-ad6f-aedf9a18398d", "comment": "Malware payload (Dridex)", "value": "8db94d203cb89759327081087207977591b69273904aaf155873688fb4284075", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450079, "uuid": "f831a062-a78f-4797-82e6-f509510e61d6", "comment": "Malware payload (Dridex)", "value": "14a8cf1eea56e4fb30fe390b106ae567b420243d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450079, "uuid": "7ad49dfc-ca6e-430c-a6db-646627a59bb3", "comment": "Malware payload (Dridex)", "value": "c5acf13c236b87559febc20ed6d64f0f434b19094c189a4c93b0954eaabe6dac26e62b49d14283e817aef4a75ae420a9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450079, "uuid": "5ff59013-d170-4917-894a-65c586d3969c", "value": "0DF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450079, "uuid": "5fb141fa-132c-40dd-ac7e-cf5ddc562325", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450079, "uuid": "6459e86f-3f30-46c8-972a-0d109b670e63", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620450079, "uuid": "442660f1-65b3-4352-9604-88695f336c43", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620450079, "uuid": "c65fa6e9-0260-49e9-93ca-7247a6200460", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450079, "uuid": "7fabea4f-8571-4307-9ba6-4322ae0b581f", "value": "d183f42d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544ff7d7-afba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620450037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450037, "uuid": "ced13e67-9313-4329-8476-1144f2a5874f", "comment": "Malware payload (Dridex)", "value": "ba65bc4171ae46d7cd76d96d679e21c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450037, "uuid": "786980fa-4db3-466f-924b-763f5c8af3ed", "comment": "Malware payload (Dridex)", "value": "8deaf14dc40a1f81ead744561995ae0a02b748b9dab2bc180692a4f4b056de8e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450037, "uuid": "89798c21-f31c-4c72-9c8a-938398f4a4e5", "comment": "Malware payload (Dridex)", "value": "87208d080ccded57f298eae5fd623d19a5d7f91e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450037, "uuid": "415faa99-2a0e-4f8f-bc90-e984dd625c08", "comment": "Malware payload (Dridex)", "value": "a97d97c5ada94de4ee3183ff066909f302ee5726aa2df060713f896e04a03b0b3fd59173329a2d65992e57d00059c529", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450037, "uuid": "d356afe8-61e2-4dc0-8f2d-09fc2c432c63", "value": "92F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450037, "uuid": "6edb225c-75ff-4a0b-9fc7-b6c74bc69de0", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450037, "uuid": "37f8b965-6164-4aba-bc0d-cd628ad541dd", "value": "3072:5lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:5lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620450037, "uuid": "9c232f19-f8ef-40fe-980a-83f8e2cbd199", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620450037, "uuid": "a13fa2ac-6e6b-4a31-a790-ceb7984ed6fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450037, "uuid": "991d88f5-faf3-4aad-991b-073d0cf34632", "value": "ba65bc41_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2642da85-afd7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620462415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462415, "uuid": "047a6d47-1be9-4759-8774-4c2df0d318af", "comment": "Malware payload (AgentTesla)", "value": "7b88926060db13c759d9009ee87b13d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462415, "uuid": "b6f388b7-43da-457b-9ba1-7d0197894a1d", "comment": "Malware payload (AgentTesla)", "value": "8deda51f5f68a5c442aef9c6538f94dc97f58f8e42fc42aa64c098b78bd70f6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462415, "uuid": "8843cee1-d58c-45e7-8d61-c62f503d8924", "comment": "Malware payload (AgentTesla)", "value": "4f9ddecdfe836801c344099983a8da84e0ed8e17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462415, "uuid": "b600578e-0c74-4883-8cef-39b24ba94e9b", "comment": "Malware payload (AgentTesla)", "value": "8c0db3b24ad5d31f5579fe13f8a9ebd055f57ed78771b0a4d3c9096afed436f9dfec65dd0f7bd245f355127c7642a94a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462415, "uuid": "11f39836-e00a-402a-8ba4-af37d9a25941", "value": "7C05F1721398BBA5E1BE67391971E12013F1BC14E632CB0E7DE5349E25B3B8149B274B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462415, "uuid": "ca23d4da-8945-4923-bdad-7fa074908204", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462415, "uuid": "9c7b7c57-3f0a-4522-a076-bccb4dcfdef1", "value": "12288:tgczv75TdHBVuUKvhOwmbtQ/gRMeKCSd2eChtjdr7Onr0ApPCOGGfNMbH:ey75TmvfKtEgXW4NdrCnrLCj6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620462415, "uuid": "6e3189ec-ba4d-4c15-831f-9dabd2890be8", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620462415, "uuid": "9866fcd4-5511-400d-9d86-100a81687a47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462415, "uuid": "f0b49ef5-7357-4b1e-bb92-7ecb5e7dc88a", "value": "Invoice documents-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc64826-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620460955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460955, "uuid": "149b4124-2597-43c4-b3de-e900991e3ef6", "comment": "Malware payload (SnakeKeylogger)", "value": "6d1d5e20af9b6e4f5f26d2f49212b9a9", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460955, "uuid": "d0cb451e-6a9e-4d3d-bc95-ed52504aaa29", "comment": "Malware payload (SnakeKeylogger)", "value": "8fbe2088242efeaede104075be29e3d570dc9b111ea4a4eae5f119b3b7d6fe0e", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460955, "uuid": "64dcad35-1b6e-44db-932f-03d7eee4d8fa", "comment": "Malware payload (SnakeKeylogger)", "value": "4a08d77fbb52421bfcf5b7d3ca6f9d48caa52f65", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460955, "uuid": "7204a7e0-4372-4fe8-8a72-31a08c3e94ac", "comment": "Malware payload (SnakeKeylogger)", "value": "9046ae52e65833cf009ab97b3bc3006f48815c2697cd23cbdc8307032aa0294ae9719e147f12aca505cfd86254358007", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460955, "uuid": "8e7143e3-83b3-4e8b-a595-970729f1e898", "value": "DCF42BD1F19088DAED6B49F1BD2BA53024D3BE9C54A4410C569EBB1B76F3342209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460955, "uuid": "a82ac3c5-96ff-44cc-9f6f-3fc3d9e91d21", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460955, "uuid": "abf00551-2393-4ea9-9752-6357f96c3e4b", "value": "12288:O0LZNtkexPYLUuTmFKEq4YsTo95nTvTMe56c:LZNDxyUuTmF9BkLTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460955, "uuid": "499d58b0-6d2d-4aaa-8b70-af5bfedd2172", "value": 755706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460955, "uuid": "195df457-d10a-44a5-b1fb-50a851df74a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460955, "uuid": "5ce220d2-fa26-40bd-8092-e6e3fb1a2281", "value": "DUE INVOICES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5774615b-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "f09abfe5-3a31-4b26-8871-8f4b05041950", "comment": "Malware payload (Mirai)", "value": "2b2c7ae53df74f6adb402c6245e0e7b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "2899d1f3-baad-4c9a-8120-c7ac009099d2", "comment": "Malware payload (Mirai)", "value": "902302c21348cfd23913d6383534dd09fe49e8e2a0e0eb31c10332494452dce1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "2b31a435-b6a0-4e09-8889-e5b5a01fdb53", "comment": "Malware payload (Mirai)", "value": "6aa12c8b58f2482fde99377984d3032e0645c07c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "dc192892-84ce-418b-aa73-9e0379db8cce", "comment": "Malware payload (Mirai)", "value": "fdd9d18876a0dcae406044832b59c932f654249e578ae68493a3bed845a59badd3bbab8d4f0ed98323d0de85892dceb7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "cb6a70cb-d368-4ea3-b056-5f2668dd4c86", "value": "11231A42312C0E5BC6A256B0253F17E083FFF9A020F4BA89665F9B568675E3611C6FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "0ca4d2e4-399d-4c85-8408-91eb87794b2f", "value": "768:kOgJWlxTcqZ1CMJRTjaVZTGRJYoNXlmHiFFvg8lbhYJAr91:NJ5Z1CMJNubC8mmHiZOAJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475383, "uuid": "061d51dc-3103-4cf7-9da8-89efdae4d2bb", "value": 45988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475383, "uuid": "3eaf4dd1-6e26-4706-8504-b74bf7e6f792", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "208435b4-7327-4cff-b3f6-56a9a73d4605", "value": "Winbox.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e6b7f8-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475296, "uuid": "f9f8bcb2-ff22-4740-8c15-283717df3bd8", "comment": "Malware payload (Dridex)", "value": "751b8be51839562838efdbb96846ae65", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475296, "uuid": "82c02d0a-0f24-40a6-9d8a-ef8f3866bf35", "comment": "Malware payload (Dridex)", "value": "902cfd6586663d17a16bf7b81b66f7bf6e50c3f0f64938f05158cefc0a0ce95f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475296, "uuid": "c0e93143-e1b0-495c-9d69-89b772bdb84d", "comment": "Malware payload (Dridex)", "value": "4c6483264a995da8d2a66807685c5a9e84f95a88", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475296, "uuid": "8c5e2884-45ec-4949-a6d2-7ece3a49d8cd", "comment": "Malware payload (Dridex)", "value": "0910ff226b0e956aeb215a62bae4588f691e3a6ccbc5e8fccab565ba0c19e24fc8a7829750a368b2f9d4f53998cddb08", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475296, "uuid": "5ca463ae-6d26-47b1-b1d7-312743c287e0", "value": "DCF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475296, "uuid": "2a440165-98ca-4b3e-9ccc-bb5d9f8ea1ba", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475296, "uuid": "788d5d7e-231f-4c52-9665-a251a977778e", "value": "3072:2iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:teAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475296, "uuid": "70b266eb-c844-436a-a74c-452d45c6e7db", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475296, "uuid": "7325f597-bcca-42bf-bb0f-74cf6db3c56a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475296, "uuid": "c194abe9-79b1-4468-85e3-ab2ed39b97e1", "value": "751b8be5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c236bf1a-afbc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620451081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451081, "uuid": "d6837165-14ff-44c9-a1db-bae7701f1202", "comment": "Malware payload (AgentTesla)", "value": "d4b4bb8065728126dff839e55a11691b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451081, "uuid": "665c8aed-fee6-446d-b923-0d016536af7d", "comment": "Malware payload (AgentTesla)", "value": "91637a4dc9db7bf02a20de67ea150e36a9bf10f7e5eff4a32b6af22f084d45c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451081, "uuid": "1f044a77-ebf2-40da-bfcd-0f3c37b49635", "comment": "Malware payload (AgentTesla)", "value": "3b39af015e315650b2c058af027881d71853bb02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451081, "uuid": "30b07e9f-7114-4070-98ae-5baa464e6331", "comment": "Malware payload (AgentTesla)", "value": "bfe677c8b938d9e29dedc5dc991878eb8ef574df1f51a857a8a52f3fc46105eaa39e6bb3afad1fd6a8dd1b5cd1bf11e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451081, "uuid": "c34f2f11-a0c0-4590-95a4-a0e66226420e", "value": "5CF47DFC725465F0E35B5D3763CF1C0642252274A93BAA0E8B6013BD5A67F173E38A89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451081, "uuid": "65cfdfd3-e9b5-42ba-8977-d8387dbd0004", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451081, "uuid": "ff5bc286-4f8f-4e2b-bd57-8d9ff4bc868a", "value": "12288:3zH1oLLoS60/K7yh0+gRbBtSvTWkTVvRxLUgHxx7690vWzayCVFoVEZin1xO4at0:71oLA+gBtfgHSCWznNVOin1xotdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620451081, "uuid": "019b8efd-a93f-4f07-8025-11dd61c7ce26", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620451081, "uuid": "3fec3f51-cb4a-48fb-a4ff-68093993a355", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451081, "uuid": "c89d2857-7f80-4aab-adc7-b34dab0ceef9", "value": "SWIFT COPY FOR ADVANCE PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20cf569-b005-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482487, "uuid": "7212f325-bec6-4d6c-813a-fb25443e04b0", "comment": "Malware payload (Dridex)", "value": "09aed52bf7e77eee0f63f06b4463d6cf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482487, "uuid": "3ca2746c-0ad7-434c-b762-879e7f8c1603", "comment": "Malware payload (Dridex)", "value": "916d51912791d75bb657fa16aca4b09d45ed89607fb9d8056ef91ea0c0f84a1c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482487, "uuid": "94646c03-fb05-4a74-bce8-3ceee3a83eb9", "comment": "Malware payload (Dridex)", "value": "081aa9b8deb8d3908d8d1f059a24199fcd66c96d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482487, "uuid": "0f5fc6cc-f274-4089-880f-7f5aac432d9c", "comment": "Malware payload (Dridex)", "value": "cf150ab17c12466f4a5cab6817bc3879201785fbc2e166458053069225e1134a95f2812d02bb58cad50d2bb97cc16c76", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482487, "uuid": "ac0478c8-57d1-4e72-8e26-257e5417e444", "value": "EDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482487, "uuid": "73313c76-f1d1-41a7-94c5-1d33d5aef4ee", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482487, "uuid": "12bc4b72-666e-4e6e-839d-2cc14f2d67c0", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482487, "uuid": "1400a35d-ff1d-4a2b-a336-d255a2f8b508", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482487, "uuid": "1d4c1fb2-d609-4b58-aba8-a2c23e464b08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482487, "uuid": "f6a00e09-0225-4591-894e-3bb30b12ec1f", "value": "09aed52b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cca8d7-afa1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620439272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439272, "uuid": "801c4f52-c025-4c1f-a50b-3bc165481783", "comment": "Malware payload (Dridex)", "value": "533403465b547eb3abc7f93d5738f5c0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439272, "uuid": "f21cb1c4-7d1b-410f-a9a7-4eb70101564e", "comment": "Malware payload (Dridex)", "value": "920a68fa69895f756891e1341d96c5370eca2fbeb3103c492c8b32b48858569b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439272, "uuid": "d75e0ea5-83f1-46fd-a6e9-1afd50fd434e", "comment": "Malware payload (Dridex)", "value": "01e11e3ce44d8db94e36f6d816a6276674ae8946", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439272, "uuid": "706497f0-c3ec-4e83-8e02-4e10b1d29f7e", "comment": "Malware payload (Dridex)", "value": "22904933d7dfef38ff70da58f56baa27f942f3240f0a44a02fc386d02ec2942da8fc54985579dadd8f003d511ff995cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439272, "uuid": "eddf20dc-2f13-48b5-a7a7-15c9e29c817d", "value": "12F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439272, "uuid": "b8fb463a-f93f-4368-bc55-c968ab3f41d4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439272, "uuid": "2e05a10f-f263-4f60-8dca-332434d7418a", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620439272, "uuid": "231df319-e84d-401c-b61f-72ec59f5bc65", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620439272, "uuid": "d788c0bd-ae7d-40c5-b394-338e4a9f7fa4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439272, "uuid": "58008d60-d777-4525-bea9-2c2c6a3e83d4", "value": "53340346_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847343da-b027-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620496933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496933, "uuid": "82875862-e18a-4d88-9f3d-a298e35f3d29", "comment": "Malware payload", "value": "fc64e1ac6687fde65b4a71636c333c62", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496933, "uuid": "c9f3875a-429a-464e-ae88-08a3278af574", "comment": "Malware payload", "value": "922c572fbe178368893ab134f00ce3817dc2518eff57e2f5ef685ffab2fa13f0", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496933, "uuid": "8fb71ed3-8df5-4961-872c-3ed47f843a42", "comment": "Malware payload", "value": "b8eeab0cb8c918aa01bdd988f18d15bf6f46c8c7", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496933, "uuid": "9690b9ba-a9db-4d4d-a954-5cc4f8967b5f", "comment": "Malware payload", "value": "b99cb62b84b8e5bc7a14b3786af0b5aca2586d92ff3866df1541ec006ef6f59a4afa89abfed5905410941c81d38d5bd9", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496933, "uuid": "e1f249eb-7818-472b-be28-c72717ed7ee7", "value": "29D53340F5267C83CCE6E531E665321163E63B94F077A8A9762C524B2829F3A0D5FEDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496933, "uuid": "12c0c8ce-e3a7-4400-8837-669f1a0e0594", "value": "49152:sdqLzRJ/83apwkCNCckIskGF8UdnFRe/Ngpw/5J4EycbTkk+/Ko:MqXM3ap/CIckpPdneZx8cbovKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620496933, "uuid": "c894e31a-a35e-4bdc-bf29-be5fe1eff122", "value": 2759045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620496933, "uuid": "9882eb39-6dd4-4e40-a12d-8191b036ea1e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496933, "uuid": "32af2d1f-2787-41db-9ae5-3c0562115fc4", "value": "copy of check 2424.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b64ab2c-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475363, "uuid": "1ffd7733-c574-4c01-9a0c-f11cc150da6d", "comment": "Malware payload (Mirai)", "value": "44ff66b9a27ec135c87aa93b05d874a8", "object_relation": "md5", "Tag": [ { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475363, "uuid": "07ee79bd-4d89-4829-bb29-bce5cb6b6fd3", "comment": "Malware payload (Mirai)", "value": "9230a9bc99fcf9a811d1db1737dccf8cdc5f1271ac00beef93c19ba53c7bfbfc", "object_relation": "sha256", "Tag": [ { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475363, "uuid": "6db3f638-68f7-4a7f-9e7d-a999dcacae4c", "comment": "Malware payload (Mirai)", "value": "fe269e475a2ec3d3411c8f154956c818bf33444e", "object_relation": "sha1", "Tag": [ { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475363, "uuid": "60248bf3-cbc0-419a-9c30-d903fbcf2cfc", "comment": "Malware payload (Mirai)", "value": "e76bd6bf57a72edb5069be5e3af1b95bf19b3acf636e5cb6877905122933561b92354b8e57cffa47c117bc2f3c909b47", "object_relation": "sha3-384", "Tag": [ { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475363, "uuid": "9a1e0630-9fa2-4850-a912-94543ce9d5bb", "value": "4A630985F4C745F5C84B4A3460BFF33FDA31DABA40305A6DEF59AE21DA37A015212399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475363, "uuid": "64d0bdb4-6823-4e6b-bf0c-397764658122", "value": "1536:+UzrP7BIluOdSIvw/ZrWwaAYXJp6loKODM:+UzryluOsBrH8Joon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475363, "uuid": "943295fa-e67e-47b0-8157-435685b17ffa", "value": 71344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475363, "uuid": "ad8cd7c8-2893-4961-9eae-74e31f301258", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475363, "uuid": "8d972de6-dcaf-4625-9e26-6d31d5254259", "value": "KKveTTgaAAsecNNaaaa.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d504357f-afc9-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1620456696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456696, "uuid": "d202f68b-526a-445d-bd3e-565814755527", "comment": "Malware payload (RaccoonStealer)", "value": "846805f323a8f9dffc33ceb3bab72e8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456696, "uuid": "a906cfda-f98a-40c8-9a21-46e1c009b7ae", "comment": "Malware payload (RaccoonStealer)", "value": "924c25e503792d12b9c161919878e29f47c1acce08cc4c03976bbc0e60ce181e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456696, "uuid": "6c11973d-d808-4911-a28f-1833bd33bf8b", "comment": "Malware payload (RaccoonStealer)", "value": "cdb7e585d7c7662ca5d42a3678be197248fff119", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456696, "uuid": "5bc450d5-5215-4e72-85e6-2beb81af6e39", "comment": "Malware payload (RaccoonStealer)", "value": "cd598a63ba1e9e7deb7a396c81ccec00a4b2b9c3953445c2203c31220dbb92373acc2342fe00424ca0f1816cea7fd676", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456696, "uuid": "1d9f3645-a5a8-4491-97f5-5d5aad89b82b", "value": "8B15021275C0D072CC661D794065CB689EABB8334B225F8FAACD1BB9EF347D17A25309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456696, "uuid": "4d7a7784-f145-4fea-9dc3-224f6e941148", "value": "e5eddde3bc28318303bde004dece8436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456696, "uuid": "ec8d7270-2e41-4de7-a7fe-95cf907501d3", "value": "24576:2cdqDGoIK/lDonpbzemZ8jnz97AAwZS5cg5UPzj1bU:hoIKOnhzZ0Wkcg5UPFbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456696, "uuid": "86825c15-11ea-4e5f-ae73-c152c86cdf1e", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456696, "uuid": "32491d2c-d66b-4db3-a11d-9fde5096cad4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456696, "uuid": "ad910cc3-c922-4e5e-b49a-e689bc64fd20", "value": "846805f323a8f9dffc33ceb3bab72e8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b689ab2-afb5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620447982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447982, "uuid": "3f747e73-51b3-4165-ba8f-9711ccd7502e", "comment": "Malware payload (Mirai)", "value": "5794fa132a25fb8da56b623f4cd7f8fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447982, "uuid": "5a488649-fad3-4fbe-9102-a51d3712f1f2", "comment": "Malware payload (Mirai)", "value": "929ed9b8c2176409b791e2a619bddcb07557a77ac65e687417f2f242b64af9ba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447982, "uuid": "9f073fd7-01eb-4c5b-9b74-417fc73fa3e3", "comment": "Malware payload (Mirai)", "value": "0530436974cb605fdd1fd67b7fa2cadffdb8bfa7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447982, "uuid": "62425daa-f52b-4b70-9810-94997ab2d2f8", "comment": "Malware payload (Mirai)", "value": "21c38bcb72e04e707ce1ad25573079fe91bfbc7c7d1f3fe14c2e06cde81eec8ad7f5f8fec0e87728f6d48f0b59725a5b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447982, "uuid": "51ab8101-941e-454c-9c3c-fbd6adbceea6", "value": "3D232AC4B482F8F9EC15457C307B97729EB7F43A603AEDABC39994239815601AA072DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447982, "uuid": "5edee74f-8ea4-49e4-8285-a11bde439386", "value": "1536:4LInPCqAAXJLE7cxtd68NqqBNM9vk9YXPSP0Hoa:FCqxpE7cxtd60qqv2vk9sSMHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620447982, "uuid": "517b906f-c3f1-4a56-ba8b-ecb498aed0f9", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620447982, "uuid": "ca3b60da-6aeb-4bf5-a9cd-3977520bdb35", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447982, "uuid": "eaf54ee4-4f6a-417f-8413-f743b0abdb4d", "value": "Josho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d271ba83-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435646, "uuid": "d9be167a-9920-4923-a954-4f29355e6794", "comment": "Malware payload (Dridex)", "value": "fa34e2f8a84fb0156035b8a721bd8cda", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435646, "uuid": "480fd8b8-54b3-4963-b444-30f9876c2cc1", "comment": "Malware payload (Dridex)", "value": "93105c09ffc1bf480a646a47719848e7ee6574eb4788f18cf4cb631b207dea9b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435646, "uuid": "1d70b731-8b7f-4bff-8c8d-a98bdf095f28", "comment": "Malware payload (Dridex)", "value": "605bdad27d07bb5b23eda7a7a498f0efdf245137", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435646, "uuid": "e86fd91c-7a2e-48ac-a3cd-e40f547b30d1", "comment": "Malware payload (Dridex)", "value": "5e8b82acd3863db9b5333c38986928c4881ce4a21f67f60e5df1b331be16cdbc55acf95f5ccc00a2414d6e9adfd480db", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435646, "uuid": "7be1d931-d5ea-443b-b6bf-bb5cb4796288", "value": "13F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435646, "uuid": "629126f8-92dc-44fd-bf7f-fe5ff21aca19", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435646, "uuid": "2cc68851-3a27-4c7f-9447-b1fcada6aa4a", "value": "3072:7WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:742IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435646, "uuid": "9ded9f15-070c-45db-86e4-3f2cb6e6c959", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435646, "uuid": "bb487e2e-6762-494d-a83f-c9fa5ee1a7c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435646, "uuid": "aeb65040-6d3f-4a62-98b8-197daedb0570", "value": "fa34e2f8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52965529-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475375, "uuid": "9eed4cd5-50bd-413d-9e2c-b3efdc2127e3", "comment": "Malware payload (Mirai)", "value": "20883b772cb8a2d717101de1bcee9ee8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475375, "uuid": "9b6b7a86-3070-45b3-95ba-27234155f756", "comment": "Malware payload (Mirai)", "value": "935c7b9b2be022ae0f1cd34f092392837c07d018026449f4ac0d555cc77f5bb4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475375, "uuid": "c2c328cb-d78f-413f-b2c4-5d82f58cadff", "comment": "Malware payload (Mirai)", "value": "7d4710684ad6990e68b1c31b3048cee417c5367f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475375, "uuid": "c4dac4b3-eb7a-40dc-86cf-89c79af67d81", "comment": "Malware payload (Mirai)", "value": "62ed9f4b49bc7d4a62d7241cff0b095ea7659a27e326356c44b33aaa7ae7ae585f96b859f123698bd23acc3b47fd91db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475375, "uuid": "2757f855-f481-43c3-8a54-7d64eb10bc7a", "value": "FE735C34A97E2F26C0C4A17E52F78750B2E5220F29B4965D7CB20F4FFF24544A8562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475375, "uuid": "d43afe23-cfa2-4607-b848-0f53394434aa", "value": "1536:vsnCSemCLLWeKNJ+1kbOSYcpC636v/bcYSZfFFi:rS1+SYccv/gp5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475375, "uuid": "1ea43859-5654-4792-8c83-abab2ff77371", "value": 75388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475375, "uuid": "e225efa0-7ff9-4aa3-9186-5aff5caf2fb3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475375, "uuid": "4f950df3-6925-46a8-a50e-9c06f35c8a92", "value": "loligang(1).spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96cf23f0-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460886, "uuid": "b6b86190-b361-43c5-8e5b-f5f15dd85a8b", "comment": "Malware payload (Dridex)", "value": "b0a097d94957d29f847f7d508c2acd6c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460886, "uuid": "bfca16dd-1f0c-4371-8050-e1020b474f39", "comment": "Malware payload (Dridex)", "value": "9364810c20f395ddd84f798c3c8db572323ae1b07089358be5ae0a49fb1b3f6b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460886, "uuid": "3002c254-e710-4c9f-b8ab-2d26cf0d7395", "comment": "Malware payload (Dridex)", "value": "987bd0fde0c1368dd61389f1edfb741318f152d5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460886, "uuid": "b7280ffc-6731-42a8-98f1-8d2da6e66179", "comment": "Malware payload (Dridex)", "value": "a963c0d8fc401b5b1a28cbc79d04a82624ceef23eee46f40e22fd37e340799542f525e80c6f40426e645bcdec0fc82a6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460886, "uuid": "83ad6f81-46d5-48aa-a4fc-7bf8a4106853", "value": "B6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460886, "uuid": "30c31f14-0d31-46f8-8e7f-21f3daaf1d31", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460886, "uuid": "302ab36c-ba71-4b72-b3bb-7f3af5f05896", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460886, "uuid": "4dbaed47-c3e0-42b6-9ddc-c06cb854f1fa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460886, "uuid": "7949a8cb-9f82-40b7-bd52-93bfde42378e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460886, "uuid": "6951c3b0-7558-4ec5-80f7-a60243782d1b", "value": "b0a097d9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7ab708-afb1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446456, "uuid": "7365a59c-81d6-4dc7-b903-19fdda16a393", "comment": "Malware payload (Dridex)", "value": "62352619ce825624b7407656451f9eba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446456, "uuid": "874be565-baea-4c7c-b6f2-cbf27f3bf9ed", "comment": "Malware payload (Dridex)", "value": "940d216aab4324a43e5f2c1fb30b67e64c51c644e145e6299368e32e2a2e79de", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446456, "uuid": "ac505fd3-de2d-4299-95cd-b493124e30b8", "comment": "Malware payload (Dridex)", "value": "b930551e511de19364784935a99da7518e208b30", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446456, "uuid": "c6def72b-ac47-4bfd-9c04-d70354f8c03a", "comment": "Malware payload (Dridex)", "value": "5092ed9134a0a7b54d81f363e1bbc243dd89084a0e65ebe08b03cbed34af3de8ce439c215f9e3d7777df6b92be7f81ba", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446456, "uuid": "7dd2062e-9eee-4986-ad35-3576f2183d94", "value": "D6F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446456, "uuid": "56cc836a-63a9-4f31-9d1b-904426104856", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446456, "uuid": "57f1ae26-c8e0-4712-9f7a-de417c5b4c01", "value": "3072:We45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:r4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446456, "uuid": "2cbe7fb6-3fe8-4857-9ad7-60b791063b82", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446456, "uuid": "f447c181-10bb-425f-8bc4-3ac0a01f76cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446456, "uuid": "7bc65197-2945-4a82-b44a-b610843148e6", "value": "62352619_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110ec5c9-afd7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620462380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462380, "uuid": "6c6feb67-5ecc-43f3-8fdf-c721096b95d4", "comment": "Malware payload (AgentTesla)", "value": "5e76d51aa954e1ff938e76a365f048d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462380, "uuid": "06a344b4-f9ee-4bb6-bbbd-ad1c1a99ace0", "comment": "Malware payload (AgentTesla)", "value": "943befa0036945370dfb61a4ddcb5ca2cbfd0f75fc5a3f7a48c4b524ed538b68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462380, "uuid": "0f71871c-c5d1-4449-8f28-6f1ac9e60dd3", "comment": "Malware payload (AgentTesla)", "value": "06ece95fd8d95f13e30fc67b3a59716399961833", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462380, "uuid": "27363c86-22b9-4efc-bbf4-6d4c25cf4bdb", "comment": "Malware payload (AgentTesla)", "value": "f3ce4a68446b8b560b96717e7ed401a3bc7dd0f52ab8dcb2e6ba45d9b422e7f8ac803d27d35e5d6864535667db986c7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462380, "uuid": "251c4a51-d341-430d-8dcf-32556fa6d22f", "value": "5505E0623341EA50D47D5B36C4A467F006FABD01F622DE2BADE43DDD79B2BD112A0683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462380, "uuid": "abccee73-3b94-45ec-a07a-588fb25960a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462380, "uuid": "a599953c-a839-4f40-b30f-ad44763aec40", "value": "24576:bYUkMwaKh2j3n9/RGCyYwMOO05yfYd2Dsxq3Q1:bYJmA2j3f5IMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620462380, "uuid": "b5701307-0c6d-450d-bc4f-3b3630f6f233", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620462380, "uuid": "fa03c20e-59b8-4204-b149-d344845c0dcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462380, "uuid": "05c41989-3bb1-4c01-bd5a-74a2e2a3eb51", "value": "Halkbank_Ekstre_20210507_012103_781211 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f0bab6-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489658, "uuid": "10cff9aa-3ff5-4d3b-845c-f01d3913af86", "comment": "Malware payload (Dridex)", "value": "36e0a04cda719409352a2a3f51fa5f34", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489658, "uuid": "7b1c0cc8-3163-4da5-b411-1246a929a591", "comment": "Malware payload (Dridex)", "value": "9568eb37b0d5294186f4328e77521e8462c9cd3bfc498452b3083ec9076322be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489658, "uuid": "774017d1-4588-40f1-b318-36ed60aae224", "comment": "Malware payload (Dridex)", "value": "b4f0766960b122c6495a3a9889013aa9d0127b57", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489658, "uuid": "37c52ab7-c8d1-4467-aea0-7f33ef3dce81", "comment": "Malware payload (Dridex)", "value": "453a7faac7caf7ef70ef6e319f82c19e892036fc453f8bd1296d4e41a776a8b0030a696047ab1553ca898a4716b1ca9e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489658, "uuid": "f2e6da7d-ffc6-443f-b217-343f170cb7e8", "value": "10F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489658, "uuid": "8903e06b-dcf8-4262-889a-2ad1fee3a15c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489658, "uuid": "3d75c552-68df-4bf3-a09a-d2b60f709e34", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489658, "uuid": "16f953c4-329d-43af-aa0a-a463a15cc03f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489658, "uuid": "9b55d9c9-c19c-4a0e-b706-42c1e9b12115", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489658, "uuid": "82dde4ed-dcce-4207-9160-3405ab52acbd", "value": "36e0a04c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f4ed7c-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468077, "uuid": "3768cb0c-1632-4609-8454-6ad8b4b12316", "comment": "Malware payload (Dridex)", "value": "07d722e3224f318317854701982f7eb5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468077, "uuid": "4b67e905-6a20-4fa2-9daa-42d02065b803", "comment": "Malware payload (Dridex)", "value": "958e9cef08bf4890bb18c7959d36af99db452409a40dd9553184378cca82196e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468077, "uuid": "ab611c83-a53e-4e8b-969d-4d07e228ba1d", "comment": "Malware payload (Dridex)", "value": "bb86d98997e46778ec75ea1d3cbeebb608a33919", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468077, "uuid": "50393a3a-dbc0-4d4d-baa4-753fafae3c86", "comment": "Malware payload (Dridex)", "value": "b8c6f682f754c950edbf2e139a3f0d30ba9c7df352f2fd65b3744d7e4501606d621e631767c2643d91e34e4fb7b4b982", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468077, "uuid": "b667f1bb-512c-4a09-ad46-380741c5bb4a", "value": "63F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468077, "uuid": "f30a76da-8a79-4191-a838-34fd4bcdda52", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468077, "uuid": "ce1f773c-1d4a-4939-adcb-09e86c4476f6", "value": "3072:ruFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:r0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468077, "uuid": "00692791-301a-46d6-9a9f-344a98c25e4d", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468077, "uuid": "6a7120c3-9435-4141-9208-1e27c0d28950", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468077, "uuid": "f3b9a493-12b0-4609-9a0a-5a9dd7f71e85", "value": "07d722e3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7f662d-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475257, "uuid": "efcac5eb-bb1d-4e29-a3fa-bd791b38b85e", "comment": "Malware payload (Dridex)", "value": "eb9fcad132ce6b38ecf5d2e62a7cfcbd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475257, "uuid": "75c89259-ace3-45fc-b167-e83970184c4f", "comment": "Malware payload (Dridex)", "value": "959a1e7e9610f987686c6937ce9cf048ffd74d6263b2f0047d8db5eb296ac24e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475257, "uuid": "85f801a7-29c8-49f8-9169-72203fac2750", "comment": "Malware payload (Dridex)", "value": "127e64b2ce8bc018625427bdf6c55a69d68b5c1a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475257, "uuid": "872ca691-dbab-43fb-b906-1cf7180d4f3c", "comment": "Malware payload (Dridex)", "value": "331ff433011ac39ef988d259d5cc1bca3e23aee01b8d30bb84e3c493c209a9e974df20fb128c4631740bd29d9f02b5d3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475257, "uuid": "6db9dab0-0455-4235-9ddf-fdf0b78e53c9", "value": "92F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475257, "uuid": "8752f642-ed33-478f-a6a1-97f4b0543055", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475257, "uuid": "893e9157-08c1-4fb5-bde9-cba46de48888", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475257, "uuid": "4c159a3b-f6ce-491e-b331-ebe874f97d0b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475257, "uuid": "4a0245b8-06ae-4a61-a197-07d0b38f5053", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475257, "uuid": "f71e2a24-c099-40cb-901f-f7b52021f680", "value": "eb9fcad1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a528b098-b029-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620497847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497847, "uuid": "db9b2eb4-0718-466b-87ab-94059f4e8e46", "comment": "Malware payload (SnakeKeylogger)", "value": "3270a6581fdc2dd2d74e649a94265d2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497847, "uuid": "bec40a56-d28b-49d2-abcf-ad7e0cb55f6b", "comment": "Malware payload (SnakeKeylogger)", "value": "95d77aec134b132e3a1ef8a9573cbc25ef6d06d04fe28d3c5129f2f8caa4311c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497847, "uuid": "dc6f6c09-6368-4aa8-b83c-84a8b1c471ef", "comment": "Malware payload (SnakeKeylogger)", "value": "c263a39d9424bd4416ca548a90508d78432361a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497847, "uuid": "7878790d-3951-496c-bcf0-426106f2a436", "comment": "Malware payload (SnakeKeylogger)", "value": "cfcb298b415fa7fbf206df2b28144917319f65ac643c3da7f49d421a44ecdbb0be7f9467972f7284c5efc71fcff2ddec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497847, "uuid": "cd6267b4-375d-4aaa-9a50-64903aea8d1f", "value": "60D412BD27EC9F21D6FEAB75A69021170A74B4536DA3F33C59EC247128337E089143A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497847, "uuid": "1823ebfd-42e6-4c6f-a452-9a57d69eef2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497847, "uuid": "ac2c5d63-1154-439e-85c9-81c997ab2fa9", "value": "12288:4mDlHQPy2GXJe00ybsn/XILnTQ+VGVzsrFQVNGTizmM:d5EyVXI0KIsGGFsrjii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620497847, "uuid": "a06456c6-497b-44bc-a166-b80f512fae1f", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620497847, "uuid": "6b95ddd9-b574-4850-a0a4-1fbe053cd777", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497847, "uuid": "7bd8c186-2089-46bc-bc30-217fa2a612d9", "value": "INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c30096-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468085, "uuid": "50099ad4-87db-442c-b871-17785a55e7b5", "comment": "Malware payload (Dridex)", "value": "7b36574bce497086bf1d541dce31667d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468085, "uuid": "211aca0c-e196-40b4-880a-4ae6289c430b", "comment": "Malware payload (Dridex)", "value": "962e04e0a403515ae36fab113f1e6cd9189840363831ec61214a7aa46e2ac1e9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468085, "uuid": "0e32fb52-bb8e-48f1-9406-f1fc88446d31", "comment": "Malware payload (Dridex)", "value": "08bdeacb1912d316bacedead57f03e68dc4430e7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468085, "uuid": "254531f3-bb4b-4da3-a7ac-e98ffc351b88", "comment": "Malware payload (Dridex)", "value": "54790ddf4f6bd1331eff51391f2a23e60ed9247b21f7c95804aec45ab28de4ef6abbbfc24788688c50cd14434e7ef641", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468085, "uuid": "c772c46b-b63d-4702-83ab-1ea0eb3e8976", "value": "E7F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468085, "uuid": "99d9091e-9e54-4be1-b321-1453c7e09a26", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468085, "uuid": "d5018733-c5ba-4695-ae88-adaab8b7414a", "value": "3072:4uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:40czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468085, "uuid": "45ac15df-9f5d-4ab1-a25d-9a4a71463aeb", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468085, "uuid": "5579144e-afff-46de-96ca-70f743931032", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468085, "uuid": "7ceb33f3-18ae-4dc7-9b9e-410aeeab1608", "value": "7b36574b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e952740e-b005-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482500, "uuid": "0a9c48da-7bf3-42cf-8f2e-4212bb19cf78", "comment": "Malware payload (Dridex)", "value": "395873e5d8d020cb071d52c904af86c2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482500, "uuid": "dd85cc85-0a5e-498b-a0ad-1b6de319c676", "comment": "Malware payload (Dridex)", "value": "96582fd90f443a274457f8ad70c5ba6374d5c5e1a88772c6e9e0d01934e45ffe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482500, "uuid": "4cb774c0-e9d3-4799-8384-6756aa6da328", "comment": "Malware payload (Dridex)", "value": "9f3ea03e86fb9eb77b9a9e67da128ef33f053aba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482500, "uuid": "44364d81-3302-4b6f-bc40-b81da76676ae", "comment": "Malware payload (Dridex)", "value": "ebaaf741a499f35736a2bef9cf16b5747e9aa57c7db96a735fcbbad0f3e196f279eec85369e9b87f1d565cbc8dfbde9c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482500, "uuid": "0df267d5-b8dc-4712-b43b-78100ad05cb0", "value": "F6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482500, "uuid": "a02fc3cf-5814-4eb9-8f7d-ae3a4b065a66", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482500, "uuid": "934b15c4-9c75-4743-a45f-6dd85a975e08", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482500, "uuid": "1fd58694-cda8-4853-8c75-ec885e270bda", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482500, "uuid": "2346d0c2-15f3-451f-b9b6-a858cf8a1a06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482500, "uuid": "ec2f0eb1-b845-4624-9cd8-6b1e53bbaf43", "value": "395873e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae90b814-afc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620456202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456202, "uuid": "73649148-b204-4864-a537-32c06d900909", "comment": "Malware payload (AgentTesla)", "value": "4281785b24e8bb2e95002f8419a764e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456202, "uuid": "e30bc1d3-38c2-40fa-906a-9d7b2e4e7c7b", "comment": "Malware payload (AgentTesla)", "value": "96abbdc6d2b0db258fca1d72a5b471bb7948e4fa083c29856a8091ab58102d59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456202, "uuid": "09550fdb-4622-491a-bbd9-6adcaae72941", "comment": "Malware payload (AgentTesla)", "value": "6218e8695bdf5554c7e68346530d7d25bacd21dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456202, "uuid": "145ca5cb-c5d7-4ce0-9ded-8580eef1e338", "comment": "Malware payload (AgentTesla)", "value": "e50dabaf878289487dc2c976773f37ce752b161f242cab43d6b2d70bd4a5fab8968c9e1c77c2494775e9e693aa22e351", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456202, "uuid": "eddc17eb-fca0-41d5-8815-3ca5cc8e5d99", "value": "21259CC59E8ABA1EC42EB771301180FCD3A36D2251CDE7D65BCBFDDA9B6368041916C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456202, "uuid": "a93c26f5-5f9e-4657-b4cb-6f56f5508a2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456202, "uuid": "2aef5e64-44bf-46b0-9378-8ad068e804ad", "value": "24576:HKVbX4CZn24UU69S9Q1RW9bPPRvCNBDCfLc:qVT/bpd9QmJHENgLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456202, "uuid": "7332dda6-7ed6-4c8e-9ed9-cd807073ddef", "value": 980480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456202, "uuid": "0d547563-8218-46ae-9b40-ac653a523717", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456202, "uuid": "0b170783-e29e-4feb-a4a5-94f8912d3dc9", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6657cb0-afb1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446444, "uuid": "6e4656fa-95f6-443a-93dd-36b9fb7fb78d", "comment": "Malware payload (Dridex)", "value": "7fd6a2d78cb2a906d0e23f7718b50ecb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446444, "uuid": "d305fe21-28f5-4b5a-baa4-852f605f0895", "comment": "Malware payload (Dridex)", "value": "96e200e41611a86930a8e6bfb893b794844f5af4f54d169c488b3288fb9a8842", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446444, "uuid": "c025d1c1-46e7-427f-a778-c4e1d9d30030", "comment": "Malware payload (Dridex)", "value": "a8900a1b51bbdf59077da7c8c4ac8abadc72c662", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446444, "uuid": "fd0f5b9d-cb21-47a5-bc8d-8a450bf71c07", "comment": "Malware payload (Dridex)", "value": "b97a28d742e31ccab6cab25a5c242ee0502187351bb877a092b3195636b1c0219cd5777269175ebc735d1600281fd8c3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446444, "uuid": "c885e268-7474-45af-bfe3-552a835b971a", "value": "37F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446444, "uuid": "9dc20b86-d2c7-4949-af06-c2b5b5aa974a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446444, "uuid": "45151992-a2f3-4860-a772-facbd01ffe9e", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446444, "uuid": "7b6635fc-c88d-4094-9245-161c8d69773d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446444, "uuid": "30315dab-bdf9-4f7a-840a-dff4e6d042aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446444, "uuid": "6c58ceea-af5a-408d-8439-267183e0bf5d", "value": "7fd6a2d7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7436060-b038-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620504400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504400, "uuid": "3377eea4-91a0-493f-b814-06506f0907ab", "comment": "Malware payload", "value": "f49f0db64337a6c2c67903398cbb9464", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504400, "uuid": "4ce2499d-9d61-4bfc-85aa-46a83856a99a", "comment": "Malware payload", "value": "971c05d47ef70364bb8b9952a0d3a0b2b37d1bfacc7d2921379a0aee843d866c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504400, "uuid": "208a11c9-1fcd-4257-96f6-ac859e194b9f", "comment": "Malware payload", "value": "1598be7294e4d9b1cd95a0e3adc8dae87438128d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504400, "uuid": "94057b19-238b-4a6c-a4d4-7d9474f714f5", "comment": "Malware payload", "value": "948f127cbf46281f2038dea9fcb9734782403b07ab47340492b7f8605fa12aa898e1c62f069fc5724a9abcf00ee14c3a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504400, "uuid": "f101928b-30c0-4d58-a34a-23ed207a57bd", "value": "A7F3D081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504400, "uuid": "c228571f-7a64-4672-96c7-fc08df531708", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504400, "uuid": "a79ef9b9-238e-4cb9-9407-fabf0966eb02", "value": "3072:yBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eH2H:SuXLcclWEc2HeSjNjGdeWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620504400, "uuid": "e4aa0dd9-032c-4f3b-82ee-01f90ecd3c12", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620504400, "uuid": "8d10188f-692c-4112-ab88-90a4e2996726", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504400, "uuid": "b90d0bdf-4706-43f9-8825-b93d9923c2ed", "value": "f49f0db6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1be6291-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442893, "uuid": "0e23b325-7f29-45a4-96b7-08a97e312511", "comment": "Malware payload (Dridex)", "value": "b848426c6fde8aaabd97c7c41963896e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442893, "uuid": "44c7fa2b-28cf-435d-b404-306937f60d50", "comment": "Malware payload (Dridex)", "value": "97ba0c341f77fe2b10434d562a1e3e8ec040803c6aa257d0ba88fd4909689dec", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442893, "uuid": "bf016b53-9e24-4da0-93e0-a66a94c0a1e1", "comment": "Malware payload (Dridex)", "value": "91843aefa7bb8e370529bdab1111c1dcb0451ff8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442893, "uuid": "79b36b2f-662e-4847-8723-819abdbb8b94", "comment": "Malware payload (Dridex)", "value": "430077a78bd079c013da9b629021647d768f6c90f9c35b11b624125f317ce8cb73c13da7c09a7ea42c4908c78591fbc2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442893, "uuid": "90debab0-2619-4a10-9df1-c5409437bb43", "value": "5FF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442893, "uuid": "37628358-7aa0-4df5-9b8b-d17abb1e52f0", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442893, "uuid": "0b262c9b-fe01-43c4-8066-8c574a7de1c6", "value": "3072:DiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:geAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442893, "uuid": "b6c848ef-9888-400f-a35f-97cfa58036a9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442893, "uuid": "a3495bf6-e1b8-4ca8-a000-c7513ad5f2c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442893, "uuid": "a8e7df77-5d55-4dd5-8603-5f28b8cefa29", "value": "b848426c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4e8052-b033-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620502132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620502132, "uuid": "0ec4fdac-3067-4b8c-a114-bbd3788ffa3c", "comment": "Malware payload", "value": "131639bf3ca42f4fdd8d9a97cfde11e0", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620502132, "uuid": "993719f4-0021-44f9-b215-b883e9dea938", "comment": "Malware payload", "value": "97e2aef18478986c555089e29a6ef38ac5dfe4109d996e7ca0abaa231535a8a7", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620502132, "uuid": "287c1a6c-02ee-4291-af6e-598cd2fc2dea", "comment": "Malware payload", "value": "46810da473153f71ee7f6ccbf3b82b4c3b16bbf4", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620502132, "uuid": "825b9197-92b7-42bc-9817-e8f45cf913e4", "comment": "Malware payload", "value": "f5c31842d0702acb4b3a7eda34eafb4c41ca399bff1099c10c9618b8e5a9ee4f23af18e8eab6048070d643560fec765c", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620502132, "uuid": "63ae5ba5-34f2-48f5-ac94-06172e5c9324", "value": "0F255BA8B14054F2C79B1C3767CFDC3142202DB4A52A951A57D43FBF39B7E632A3858A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620502132, "uuid": "5a915c17-8f99-4b3b-861a-bd0dae66fbf4", "value": "24576:9oLAZvsmNtRCDskZAAh7nI152MMMMMMMMMMMuMMMMMMMMMMMMMMMMMMMMMMMMMMR:fhSDskt0WMMMMMMMMMMMuMMMMMMMMMMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620502132, "uuid": "aafb86a3-c2fc-4093-b30e-7ca7e7364069", "value": 979230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620502132, "uuid": "92541c16-9ebd-4bdb-8bb4-49c01b437470", "value": "application/x-ms-wim", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620502132, "uuid": "fc832b1a-4862-4ebf-a208-9f8d654d9cec", "value": "NINGBO-ORDER TP-20210345002.wim.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b28fa0f-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475255, "uuid": "d2e413d7-bd64-4ebe-b0da-80f4d2791150", "comment": "Malware payload (Dridex)", "value": "ee7a44f79b93afe79f859e361c57c4e9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475255, "uuid": "599160c5-3a02-4e7d-82f4-6287ecc99514", "comment": "Malware payload (Dridex)", "value": "981461c6e241f9f72a2ce0f793af9b53fb716320b05c9d771b84ac35e89e3716", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475255, "uuid": "e7f14812-8750-46f1-8ca9-6f9d08aa96c0", "comment": "Malware payload (Dridex)", "value": "4b41693dabfe7f91047319b0288beab3d89541cd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475255, "uuid": "021048c2-7cb0-41ac-8221-db7643f61028", "comment": "Malware payload (Dridex)", "value": "e7a0b0f64671c7609618ccc8f301096084d2a0255a4966b22343eb360aaa47053baf7828162752178087254705305b5a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475255, "uuid": "f4c8b527-cd53-429e-a1d6-6ee6e1d087c7", "value": "57F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475255, "uuid": "5fa08b7f-43e7-4d6c-88f3-f69ac93ab535", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475255, "uuid": "16aeae25-40ac-4721-be2c-c6d59ae53a8f", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475255, "uuid": "6e1f98a5-b651-4d11-8c5e-daa6eb9acbf9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475255, "uuid": "b0c93d32-aab5-4675-90d7-5706bf9ca049", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475255, "uuid": "b8def702-21fe-40e0-bca9-978c53461c62", "value": "ee7a44f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a0e426-afb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446495, "uuid": "ab7e641a-96dc-4183-a6b6-0076425218ff", "comment": "Malware payload (Dridex)", "value": "76361e54f5f40758dc364be5fbf6fba1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446495, "uuid": "64d100ca-5896-4237-af80-b2ee4594b7bd", "comment": "Malware payload (Dridex)", "value": "99f4d76d08dd179bf514d891fa90b20442b51cce4f98aaa47adf2302dc14268b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446495, "uuid": "9e48abe4-ba11-4d68-a30c-1a519853cdaa", "comment": "Malware payload (Dridex)", "value": "e77ca56242c34fda3d827b90e4f4339d664feaaf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446495, "uuid": "8899b224-afdf-4884-91d4-4cffe5b86b93", "comment": "Malware payload (Dridex)", "value": "a9f3978fac63ce392a2f7f1c47ede0cfd9ba7090beb120d98ce03175a6555e8610757befd34f1c50acbf1ef7727bf5ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446495, "uuid": "28408401-6526-41c5-9b52-4a5824462cbe", "value": "17F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446495, "uuid": "d0de0bbd-2467-47b6-8e1d-d1ca124efd81", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446495, "uuid": "04d0a36d-17d0-4726-9914-0345a6c81890", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446495, "uuid": "acb9cdee-645e-4b3e-9480-e0e23ca19bf7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446495, "uuid": "7c33aa30-cf03-4727-953c-bae7a6f57fec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446495, "uuid": "2d2a8c05-56de-43a0-bc01-56cc8e7480de", "value": "76361e54_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbed3ac-b049-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620511367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511367, "uuid": "feca4812-8369-4116-80f0-a89a42983123", "comment": "Malware payload", "value": "7f87bfb367ed428b756c0f6a9c2378ff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511367, "uuid": "5e443829-c78a-4ffb-a1ea-c08bfd520ef5", "comment": "Malware payload", "value": "9aa4e99bf741816f2111385cc782d8a257785b20e2169684e442a8ad38b63d8f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511367, "uuid": "e201239f-6562-4b17-8d1c-06ce033a2f66", "comment": "Malware payload", "value": "7bd00422c4c22caa769b7768672b0597ffd6c4d1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511367, "uuid": "56cc0092-1d65-4061-ab3b-2eeccd86781a", "comment": "Malware payload", "value": "4d3cdc7bc8238b12de1cd6b40e6f01bf52044477ca4798c1a0d63b700b7f4cc212c6f02bd82b7dfc5edee2c1e3dc2c0a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511367, "uuid": "3ce36e71-2668-4ccf-b290-58213cf9cc09", "value": "EEF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511367, "uuid": "230ad4b6-c0f1-49b1-93ed-d282d6dd3039", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511367, "uuid": "f1d726aa-5f23-4da4-af5a-23f7d1d824c8", "value": "3072:klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620511367, "uuid": "5137846a-03de-4a57-b8d6-71748fac3cf4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620511367, "uuid": "e15236a2-90ce-45b9-81e5-cd574565c469", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511367, "uuid": "af5f0e06-8e7a-40df-a672-033fb42fb788", "value": "7f87bfb3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5983bf-b005-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482533, "uuid": "f91b3afc-949e-43b2-b2e0-5238df81bda4", "comment": "Malware payload (Dridex)", "value": "8c5bdd2c7339c44e2802e8d175001646", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482533, "uuid": "1b7da856-108c-45ac-8aed-a6b89b5a4a24", "comment": "Malware payload (Dridex)", "value": "9aac19dc0fe19cd462a22cff812f0861e5a6591f782c8b0a386f7dfb093f7182", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482533, "uuid": "1283cf56-c0df-4e72-9574-b50f4fe94d57", "comment": "Malware payload (Dridex)", "value": "6baf4b12f3065e792e4d0a97f023d08f639fb501", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482533, "uuid": "aa91344d-6ca6-4d1d-bce5-02efb77f5664", "comment": "Malware payload (Dridex)", "value": "32b44d737af4ed99f3cd8cc1a03a370b25f59e23aeaa0f576ef32c6a16b256bcf01558264b5946b3c4b20099ef7ca1ba", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482533, "uuid": "15179f31-62bc-491f-868f-adc3939f9bbe", "value": "07F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482533, "uuid": "9adf751d-146b-46a4-9a14-a4e087785b62", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482533, "uuid": "e4d455f6-74ce-49c2-a1e6-bcac0072c5ec", "value": "3072:Ye45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:t4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482533, "uuid": "8083d92f-08dc-4fa2-828d-cafc9cdf4160", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482533, "uuid": "485773d4-3aa0-43e1-abf3-d9a288c6b4fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482533, "uuid": "3c0c239a-5466-4ff4-815b-8b2c4f04dce8", "value": "8c5bdd2c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63add02b-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468102, "uuid": "b9d9ddcb-45db-4aa3-b515-eb4025598835", "comment": "Malware payload (Dridex)", "value": "425521f69ba3b45c3395f86d7a3a812e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468102, "uuid": "3896b042-1c99-4da8-9cc5-608f2f8278f0", "comment": "Malware payload (Dridex)", "value": "9abe88091e64c91a9e6371f03a9579278b4c79b3219c80caeedf4d8cd0416303", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468102, "uuid": "90846e8a-a3b4-47ff-986b-bb2969c87da5", "comment": "Malware payload (Dridex)", "value": "b264c95c5d09a8477923b50c079ca3fbca75433e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468102, "uuid": "18942ab8-187b-45ae-a6aa-6cb7d40d8a01", "comment": "Malware payload (Dridex)", "value": "23e7eacd466d545b15aacb6dc1c631bc822c7edddc81296be03a104b6c6226204042730775f1777744a641ce2167049c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468102, "uuid": "081e0116-23b9-4559-b7f3-29937ceb5f40", "value": "5FF3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468102, "uuid": "40cb800a-c53d-4954-8d41-30746ca4e971", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468102, "uuid": "03f1092f-9015-4bdc-b3fd-172cae6a5564", "value": "3072:WuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:W0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468102, "uuid": "db8cfb6d-ea8f-4947-b040-079934e72166", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468102, "uuid": "21b2e8de-c2bc-4063-bdd9-fc5e33a21d86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468102, "uuid": "ce04bdd2-b712-4a8b-abe8-15efdc351a58", "value": "425521f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5238560d-b020-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493842, "uuid": "c8b90693-9f30-40e5-919f-ea2f5a8251d6", "comment": "Malware payload (Dridex)", "value": "e2962bcdb165c297402bcea59d0f81f8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493842, "uuid": "c613f23b-62c8-48be-ae10-99948fc4dd4b", "comment": "Malware payload (Dridex)", "value": "9b57293805fc3a2fb186fee53d0f0446f1fa6b3babee7ee7daa9fb6ea24df609", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493842, "uuid": "11843fa7-3ee5-4a18-b2ad-fab54e9e94da", "comment": "Malware payload (Dridex)", "value": "3c163a6646d371da07057ee956c6206aef61dab8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493842, "uuid": "84ff84ce-b60d-40ca-8f99-beda75a0245d", "comment": "Malware payload (Dridex)", "value": "9367dfc6f688ff579819c516ac10367541ba77c59db24748fc8087d77f233c5c7b0c65644e8f149200059f2482cb32d1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493842, "uuid": "947c6328-8a7b-4223-a9eb-1df329412ab6", "value": "19F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493842, "uuid": "2bd243c2-4a2b-44fd-9796-66d300f27632", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493842, "uuid": "93e56e6d-278e-446d-87a7-1ad466bb739d", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493842, "uuid": "e0126f3d-0372-49fc-bdc8-af2828f5cc3f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493842, "uuid": "85cdb6f9-dbfa-41f0-a542-63593f57d28b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493842, "uuid": "2f178f43-2154-427b-93c2-ca46a32f3f1f", "value": "e2962bcd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ffddfb-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471676, "uuid": "4fe33304-5441-4f51-becd-733582f18fd3", "comment": "Malware payload (Dridex)", "value": "525b49ed65e433a309ef15b9c1140412", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471676, "uuid": "9d062107-a523-4247-87ed-9bcb5795a3e5", "comment": "Malware payload (Dridex)", "value": "9b7d8b3bf60d4032c91134c9cfe35cf0e59061945d54abef39254351061b19b3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471676, "uuid": "882e65e3-c59d-437f-99e0-7a6603205388", "comment": "Malware payload (Dridex)", "value": "2d1b46d87bfb6b120b9ac841de45843e633d3979", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471676, "uuid": "d5a03dc8-7bfc-4bd5-8cab-98001a45dc41", "comment": "Malware payload (Dridex)", "value": "75113410f38d53545cde8f3b242822d6676586b915639354bfad90cbd398c85ac383f658b093788000b3340c9e84a1f3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471676, "uuid": "c54e566b-15a7-4217-8b97-dba7d67cfa94", "value": "16F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471676, "uuid": "32088781-040e-4702-a57c-0e8c8a6c0408", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471676, "uuid": "aef716a6-a8f4-4fea-8781-940445b21f2d", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471676, "uuid": "9206f560-3fba-4af3-bab9-2302c07c7032", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471676, "uuid": "4dce4c64-ea0b-4a34-bc21-b377bcc2dcc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471676, "uuid": "07f286f7-3882-4ec3-a090-04b0551fbf4d", "value": "525b49ed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b320e052-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460934, "uuid": "6200351d-b070-40b5-9d4c-d86f73e1d50c", "comment": "Malware payload (Dridex)", "value": "8d8489f41271b59106ec61204c0d2cc2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460934, "uuid": "b0473c06-faf2-4f5b-85f1-6d5aeeea3090", "comment": "Malware payload (Dridex)", "value": "9beb5231c2a17564404e2913be508887ba90cac66059a5e8e6ec7bcf9eb9d9ee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460934, "uuid": "10530922-a750-456e-b5de-39cd81c340f8", "comment": "Malware payload (Dridex)", "value": "6c5dc526ba3b742cb358647110600a1ceedb1f54", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460934, "uuid": "bebb646e-85db-4601-8cd6-b5e21b9b2c19", "comment": "Malware payload (Dridex)", "value": "12beaf9a1d8955d2ec8821feb922e46363840dc916188a58c439b6685d8a19262fe37d15408664a58aded2074605c0a2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460934, "uuid": "7e5c0e0b-903d-4a60-b7a3-3d0e472074d2", "value": "C6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460934, "uuid": "bb079ab0-00ac-478d-b58f-f308435ed8d5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460934, "uuid": "c6bc69d6-3244-42f1-bd2f-f40342fcc758", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460934, "uuid": "e50d729d-5498-4f23-8d25-088095d8d0b5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460934, "uuid": "a1cc19fe-00c5-46bd-8d28-c9f27f47a987", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460934, "uuid": "76fc5678-c8ca-4ae4-9b6f-cfbb60603b78", "value": "8d8489f4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b02f34e-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460840, "uuid": "5777017f-1bf7-4157-bc9f-866e05bd4761", "comment": "Malware payload (Dridex)", "value": "7e3339fbd645faab5f96d14c59aa0bd6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460840, "uuid": "49402223-245a-48b4-9632-e3a5040a4fc5", "comment": "Malware payload (Dridex)", "value": "9c1aea8982da7978eabb7f545cac47ed4fd4d7213bdf8f4214df51e9e0f5433b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460840, "uuid": "307ce035-885a-4f32-9f22-13008827b2c5", "comment": "Malware payload (Dridex)", "value": "602e9a956c887ff02a6ac8c2d12583eb112ff1da", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460840, "uuid": "f7c89ab3-5a2b-4f72-bce9-fb3a2ae8dbd5", "comment": "Malware payload (Dridex)", "value": "1882a7b181d2a6172202b850c8097af7f3ae3cc01ba394736bc37ea020d8333a2ede024c5222f187b95a0a6e737438e8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460840, "uuid": "b11743d0-faa8-43f8-a8dc-9f40804d5c3c", "value": "7AF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460840, "uuid": "2070a88d-6b03-4420-8def-a076bee87f1f", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460840, "uuid": "5f1bf963-e5e1-4588-b597-96b3993483ef", "value": "3072:lA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:l3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460840, "uuid": "032d83ee-775d-4dae-b20b-48c20c332606", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460840, "uuid": "98700ea7-0fc8-44f1-82b6-34967468cfea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460840, "uuid": "1774a74c-2d07-4f63-9606-f32a7c9bce89", "value": "7e3339fb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3593483-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471672, "uuid": "62d78a1d-732b-4408-a283-b9b234eb629d", "comment": "Malware payload (Dridex)", "value": "ef39181720e074c13dda3b256e550c75", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471672, "uuid": "79896c14-c6a2-42d0-ad3e-3593ce1dd708", "comment": "Malware payload (Dridex)", "value": "9cf96c15268daedb1784904f8ac7c279146fb04db8226beb1b3d74ac48e048b6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471672, "uuid": "c9224639-fdf4-48c4-bedd-db27d07507de", "comment": "Malware payload (Dridex)", "value": "f794f0c616b702237cf9d9180fe6b5dac4cb62ad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471672, "uuid": "cf7c0ba6-00f7-400e-a906-d013afb3ea04", "comment": "Malware payload (Dridex)", "value": "fb2f63ec556856df07ef104ed31b0b2f4e317dd2c2aa19aa713bf6548c166a31ed052cbfab7e0a860ff1dd5803b30ae5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471672, "uuid": "6f69be7b-be6e-4190-9bee-cd8c4ca4cbc8", "value": "BFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471672, "uuid": "135f6338-54e6-44f0-9df9-2018d1d81a65", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471672, "uuid": "90323150-6fd4-4f26-a986-5ad33ced0caf", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471672, "uuid": "3aa73550-f59d-49b0-9a5c-34903d9327ab", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471672, "uuid": "b827a8c2-b16d-42c4-b6ba-dea2223eae94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471672, "uuid": "70724cf1-2c7e-4712-9aaf-f2f257a1af81", "value": "ef391817_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee457d3d-afdb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464469, "uuid": "0693e1e7-72dd-41d9-9d26-b53258ab7bef", "comment": "Malware payload (Dridex)", "value": "319507252b6adf2777f383bc92916b35", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464469, "uuid": "8f70c911-a980-4c1f-8a97-fea01887cc0d", "comment": "Malware payload (Dridex)", "value": "9e25bf9542d96d5d02ef5aa1f20c41a9c8672b0037ee1a157a5867913adde993", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464469, "uuid": "f1491352-e9e4-4ee7-b99c-456cc44a1496", "comment": "Malware payload (Dridex)", "value": "f5d9d304f589d80fe5dfd8f63d6a98769210b76d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464469, "uuid": "865bf4c1-bbea-44b4-b7dd-3ee0e0f9033e", "comment": "Malware payload (Dridex)", "value": "38eeac99b430455be94616f4d834b16f5032fd2405e26c3a8aa456d6913028ba71c435ed9191d1a8f9583618efd84967", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464469, "uuid": "7eabd36b-517e-4255-8701-1ee3d9066691", "value": "4FF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464469, "uuid": "61e9246f-4162-4ea9-b3de-d0be8fc2671c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464469, "uuid": "a85d6ebb-01f2-4477-948b-4211110083e8", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464469, "uuid": "a5519ccc-086e-47ca-b296-dbe9b4aadbe0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464469, "uuid": "4c7c2dd2-b7d1-4680-aede-6c982a487015", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464469, "uuid": "bcb82c2f-f85e-410e-b2d0-381dc8c91941", "value": "31950725_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c57cb76-afd7-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620462453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462453, "uuid": "1f0fb47e-f298-40cc-9f98-ab846dbca2b1", "comment": "Malware payload (SnakeKeylogger)", "value": "c06baf17bc1cdb4d032d8c3af3508e37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462453, "uuid": "ca10eb91-2099-4c14-86e3-0574909f192a", "comment": "Malware payload (SnakeKeylogger)", "value": "9e49394ef2a90c547ed4ec122d3ac11264d7e0d587383fda135f1b7bb96c8b88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462453, "uuid": "662c6a51-8392-452b-a253-848fbaa67d40", "comment": "Malware payload (SnakeKeylogger)", "value": "69821b780eb3400244e273b1dbfe15be3af067dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462453, "uuid": "048c0173-3d69-45ea-9190-8ddfcfc89d98", "comment": "Malware payload (SnakeKeylogger)", "value": "e1b8d0665cccc0bced29167bdbf876b8f42c07355a496f37eb65b28655593de39b8c762df4a42fd0b7d873149443fdc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462453, "uuid": "fdfe39bf-49fb-47d8-a672-d86aae9117fb", "value": "0B05E0366680AF18E0BD7BFA49B1845057F5AC018632C21E6CF5399F6972BA3DC6170F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462453, "uuid": "33fe08a1-ec36-47eb-a505-80b7553932ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462453, "uuid": "8b9aacc8-8cc7-4cda-aadf-3b1a1b9a3af9", "value": "12288:f+YHaMZ7djrl4OG93ygD7Y+LO4cEdgsjMVrdSwKmlafHrLwU9Ld:mZmdisgDkueSjMlsFgU9Ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620462453, "uuid": "83dcd1ac-fc00-431f-a6db-9183368537e2", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620462453, "uuid": "ed81ba46-e09c-4b14-8e1f-cc9b0ba91eff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462453, "uuid": "6d8322f1-5a83-4140-bf4b-45c1199c08ee", "value": "Qoute.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762e1f67-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432055, "uuid": "07734bff-c4d2-4419-aa1b-d9062d2d6525", "comment": "Malware payload (Dridex)", "value": "b07b381d264e0d174012d35dcd378ede", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432055, "uuid": "c39f4ac9-a46d-4248-a343-3defe6a6b016", "comment": "Malware payload (Dridex)", "value": "9f1e780ca20afd3c647062d57de431c002577cb96fc870df184d1408aca9a084", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432055, "uuid": "2e781c73-ac72-40c0-bd53-fe5a6f7cb03a", "comment": "Malware payload (Dridex)", "value": "db45b101c1fb307ea176ea525459055f8c4a6456", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432055, "uuid": "5db47f40-1450-4f8e-97f1-352a6edfc639", "comment": "Malware payload (Dridex)", "value": "a7b497beddd5f5bccf177df6f3c882b6c6ab577af50019a22c8acd6ee5960967d533479150f877e6c1d434a1a473a96b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432055, "uuid": "2fafddc8-0c24-44bc-a582-0bd80a1c6c54", "value": "4AF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432055, "uuid": "4e65a2ca-4e04-4157-8b23-d10094593527", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432055, "uuid": "a18146f8-fc48-4223-ae6d-4fef20a683d5", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432055, "uuid": "4ee3e030-e254-4b02-914f-0dda9a18a43f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432055, "uuid": "91e8d60f-5b7a-4c3d-92af-009067e45b79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432055, "uuid": "e0f7fa7a-713f-413a-b1b8-a5ced41b0a6f", "value": "b07b381d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f5cca5-b020-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493817, "uuid": "a577c7c1-1e20-4086-a36b-6a5e9bfcf8c6", "comment": "Malware payload (Dridex)", "value": "99a2c3d9bb0a57fde2d6e6a35c6a98c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493817, "uuid": "bd8b8701-4686-4a88-9a05-e5565c08e963", "comment": "Malware payload (Dridex)", "value": "9f6bc8fc161f3bf6796f59386defba27be0cc9aa048812cec4fbc8eef20c5931", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493817, "uuid": "f3a99970-2dfc-45a7-94f9-6dc9a033718f", "comment": "Malware payload (Dridex)", "value": "727ffde9d94f6487835c1662ae9a5a6afac99d35", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493817, "uuid": "5f6a994f-8cf4-47a3-9849-ef259cb1fcbc", "comment": "Malware payload (Dridex)", "value": "b97bbaf69753c1fda5d29344314b320df1118e6db17d0430b26844ac641a30be357f4952d117d5e70fd0e3f286c54a6f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493817, "uuid": "f94a30c1-ca96-47d1-b122-c09c96de90da", "value": "63F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493817, "uuid": "99f3c0e0-94f4-4076-8e6f-f7c227cbaaa4", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493817, "uuid": "55da52cc-e810-41e6-a427-b4176b496666", "value": "3072:jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493817, "uuid": "7d79508b-3ba7-46b5-b9df-1a5c307b767d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493817, "uuid": "3693cf99-1aa4-41d6-a516-0c1f48bf198d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493817, "uuid": "640ebb04-1550-4c3a-aa5e-64228cbb31df", "value": "99a2c3d9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b71099-b01f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493506, "uuid": "886e8f64-7e6e-46f6-af99-d248490788c8", "comment": "Malware payload (Dridex)", "value": "f55aca2c1c015d727625e044babd7e2d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493506, "uuid": "d9611751-bbf9-4bbf-9d8c-0cd5290dea70", "comment": "Malware payload (Dridex)", "value": "9fe1f304e14c9f1ff1a44c2c54cc9264f8eb6317e02ed38c52f8457eba8f7d02", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493506, "uuid": "e077b641-4c75-437b-8192-fe11cbe5b352", "comment": "Malware payload (Dridex)", "value": "6089266c7a371f7bc3c4f9024d59c646fe1ae8ba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493506, "uuid": "5a91ab0f-73a8-4680-a6a9-d283dae3cd86", "comment": "Malware payload (Dridex)", "value": "f2b655da7c74c954968b1e10c26c68632c273e4e3284f9a77254bb6b1332966443def8c001fe33f20cf3e1434198d69c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493506, "uuid": "3b483268-e6c6-4da1-bf80-7be51b12720b", "value": "F2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493506, "uuid": "cd739975-fa34-4752-9a71-776166573f0b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493506, "uuid": "23a7b1e4-b83f-427b-83db-68d31ae8a623", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493506, "uuid": "f5190d1e-27ec-4060-9588-6a089690547c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493506, "uuid": "e5532243-e351-47dd-a774-da8471a580c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493506, "uuid": "b308a25a-7dda-4393-8cff-0434103a5fba", "value": "f55aca2c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d80f56-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457256, "uuid": "0391ba80-8dfb-4f66-a0a6-ddb90975bf6f", "comment": "Malware payload (Dridex)", "value": "53998d972fc8da3770b1b5e8d4bfbca4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457256, "uuid": "d5027fa5-d9d0-4bc9-b8af-ed5f15bfb4f8", "comment": "Malware payload (Dridex)", "value": "a0a5c257da5ba1aeaaff9036fdd704faee2cc93b2fd12578e770771a2d05a234", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457256, "uuid": "1712e4da-3a90-4f0d-959b-41807728f665", "comment": "Malware payload (Dridex)", "value": "83d09ec0218e2e719bbe80e557cfddd9d7901267", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457256, "uuid": "d21b9fd3-8222-4e70-8ffd-a5980fb2dfff", "comment": "Malware payload (Dridex)", "value": "679840ce86f82fab9918571f126b7307d905f767c0c5a69ca78d67c5e1297387183299cce7a26f8059956e0173dda9e0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457256, "uuid": "e49d4b18-6fa1-4904-b310-00a9f5a51736", "value": "2CF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457256, "uuid": "071b3182-4c0d-41ab-b510-18b744f3eb0f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457256, "uuid": "64a74434-de98-4a58-9e28-d63a75d7cb5e", "value": "3072:cIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457256, "uuid": "ab5d9713-5ed8-486d-a5aa-48a420464da4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457256, "uuid": "3aa24ec6-e5a3-473d-9cdc-75d3a831ccad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457256, "uuid": "34e7d0dd-f7f4-46ae-8cc4-54ec85a92b72", "value": "53998d97_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb13250-afc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620456069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456069, "uuid": "c5612a1f-adab-4f26-8b4a-f351cb941fde", "comment": "Malware payload (RemcosRAT)", "value": "6e6d28191079ca5c04b0eab5b98cd076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456069, "uuid": "4ead8f7d-9763-4db8-83d3-331fec3d5b6a", "comment": "Malware payload (RemcosRAT)", "value": "a0bb5a244b144a8e10087fd70a04580c3bb8c4c8add7da671a06f10020473004", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456069, "uuid": "f5525546-fe11-42f2-a73a-c013cf6ad1ed", "comment": "Malware payload (RemcosRAT)", "value": "83486f15158b67bf5c811cbfcd81f3aae42fcbcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456069, "uuid": "d2d89b61-1a8f-4efe-b458-f4a1e9924c8d", "comment": "Malware payload (RemcosRAT)", "value": "262822c0f1f85a2900c2387bf4f43984ac6aa1939c7d4bb5cceed5beae61b2df0861a954300f4531372120e37b57cd17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456069, "uuid": "ccf259c8-5fa9-4844-b4cc-3538d01b6081", "value": "F6F49E21B3E10937D1AF1A785C6BF765AC36FE001AE860471BF47D0C6F7968239292D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456069, "uuid": "ee531d37-ff51-4722-a738-5dfe1d2c3ea2", "value": "b124d6d7906bfbfc346167632abb74ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456069, "uuid": "28ab3d35-b6b6-4e99-a1a0-fd2650126d98", "value": "12288:pL4F9NDkBISBvY6gjo1gsUM6fZdLya7FC3OOU/Oy/c:pUF/SS6bqsxKB/FCjUD/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456069, "uuid": "c55b0f3e-8ddf-494f-8265-0161f6315259", "value": 736408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456069, "uuid": "1253f4e4-cd49-4ece-bf8e-2800147749b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456069, "uuid": "23dee5ee-cd0c-4309-bd46-9890b3e1d8a8", "value": "Contract_Documents_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fea599-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475436, "uuid": "6b00b964-593e-4338-8b8e-cecb435dab09", "comment": "Malware payload (Mirai)", "value": "292365674ef13b22bc0feb4c945179a2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475436, "uuid": "871ca4a9-87c4-4b8c-9641-d866faa68421", "comment": "Malware payload (Mirai)", "value": "a20dc7925f6271a40c1a36ed66cbec842d0ec9c12e0bf48cadaa95c648ce6197", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475436, "uuid": "8ab27a8d-b445-4258-b157-3b0fa659ef29", "comment": "Malware payload (Mirai)", "value": "2feb55c80d8133c02b3fbbd07c679c04230cc89c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475436, "uuid": "fa377afa-d686-4ee8-95ed-2546c1150351", "comment": "Malware payload (Mirai)", "value": "39c057cc4e5d6c9af969fa8c92729219313bca92d53393c56d384578e4ec54df15adb4e41f5a00caa66e17668e1e64a7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475436, "uuid": "106e2510-6a26-447a-8c7a-bb9dfd390351", "value": "8D83AF31D179EEA8D1628638B6458C359B23A18413A37EFBD6C187A350879ECF405FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475436, "uuid": "f480cd04-6fb7-45b8-82ee-54e6af6b9d05", "value": "1536:q/RfcDVMgaMwtKnT1qtZF/Tw5gAYUs1nFS3jqybVoBjLfxv94CKu6U:qpfi5fnT1qtZCKFJnFS+yxO/xv94qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475436, "uuid": "48871e61-6192-4d2e-96a4-15d004668857", "value": 82932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475436, "uuid": "9bbfa3af-f611-4c8a-a913-1a05d7135b68", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475436, "uuid": "6ee812bb-2805-458d-87dc-acd5a2ae0122", "value": "xd.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562bd1e5-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620475381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "b2001790-1bd2-45de-8db8-65a6ac9d526f", "comment": "Malware payload", "value": "3c98b86ccc79c0577cd0a54d4ca79a52", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "d3df9f74-a031-465c-ac26-9e821291c432", "comment": "Malware payload", "value": "a28939a48eacde0dedb50d4d7cfea4f53a978e5ec77955dd531628d23eaf680a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "f42e919d-caba-4a17-a63c-15795ddf59c0", "comment": "Malware payload", "value": "795f752d3bef4e89d9b76ad870edf42cadb44fa5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "bd9af7a1-1382-45d2-8b0e-d99aabe69653", "comment": "Malware payload", "value": "5936a281ae0bd069d28193ccc70ace285826736dd6654a7070d0a3dc3d5077ed20c748a35e0276b657c4f909e51201f7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "3e6bcf75-4753-494a-b315-cb06335f1c9f", "value": "FA73287399168FB2C016A4B121B65E740F12BDA31E5F1AD96434FAE4427F5CAB00BFB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "9b065f26-0f2e-458c-ba70-927baf0d0681", "value": "768:NZ6bqfSeo1F2LFhn36+XBXaH3ZKeKpVavbofVbgSkDhsfVHOtqv1+wpbECESIZ:NZKqtiF03KWBXAKeKp4v8fKS5zt+dCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475381, "uuid": "53d34de0-ef79-4455-8718-bfa9b3ccbe97", "value": 78508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475381, "uuid": "c1493220-044d-415e-a05e-1de251ca364d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "106531c2-28a5-4d9b-b897-b7df49c7e414", "value": "SH4(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f06894-afba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620450062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450062, "uuid": "6d77db2e-1536-43f0-a88e-0153070f0623", "comment": "Malware payload (Dridex)", "value": "29e7b8999c569e014f0f3e032e0a6c77", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450062, "uuid": "a34f0532-73f9-4082-b326-ebccc1eb6c15", "comment": "Malware payload (Dridex)", "value": "a330a00cf208b7e737785cec75be369f81e386aaa8fef3fa8f4fbbd0a94a5d35", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450062, "uuid": "b8fe14f3-bb8e-4dfc-851c-2c2904d41432", "comment": "Malware payload (Dridex)", "value": "b05c778e52bb0cc85816d8e895b29d5d57ce1ef1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450062, "uuid": "e9ac6cb2-409d-4979-8e91-25571c60b109", "comment": "Malware payload (Dridex)", "value": "0f094d97b4a903d17ff3e9557f4a0668f35fee14a4aabed45bf89521113ac0c71ef8c784db7feef76226978204fcd90e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450062, "uuid": "c20dee28-2c92-4bb0-be20-a3c081523836", "value": "96F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450062, "uuid": "f80e2067-b311-4c64-b8d5-d131da895ed4", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450062, "uuid": "b9219078-b965-4752-b323-fb107b43dc60", "value": "3072:jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620450062, "uuid": "959c8576-b653-487d-90de-efff5e71d8ae", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620450062, "uuid": "bafe5c8b-f46c-4c01-9cff-1aacbf54d4e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450062, "uuid": "92de4255-4dc7-478b-8354-30bdaa2238e6", "value": "29e7b899_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e44df72-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486078, "uuid": "973ab8f0-e00d-4b1f-a066-a3b342a78ed4", "comment": "Malware payload (Dridex)", "value": "dc81a0a50c00dc8c8144afd2a276b43b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486078, "uuid": "669c7286-cbe2-486a-a062-fceb54868523", "comment": "Malware payload (Dridex)", "value": "a3fd49259561406a8ccb0ed0b18b14afc48649478333bf3169ff313b75fc2771", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486078, "uuid": "41f4716a-480b-4383-bf93-f8acf7622382", "comment": "Malware payload (Dridex)", "value": "44324b97b6d8e19e61a12297de6d55c49230c665", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486078, "uuid": "543e76b0-39f9-4691-9fdc-3af51a7c74b5", "comment": "Malware payload (Dridex)", "value": "728546459545a3ab6b6f6e4accfccc76f45a73b6cf692622c16416f6ee469adc9add7d0702099a83d218484bb8363888", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486078, "uuid": "3afe1731-901e-471d-a54b-0db013a2f694", "value": "DAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486078, "uuid": "f5923118-da9b-4e9a-a41e-d6d27f0f339d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486078, "uuid": "21d5b85b-3cfe-4c35-8274-5466bbf53efe", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486078, "uuid": "d8301535-a4a4-4181-8348-b1392e1c3430", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486078, "uuid": "1528af67-3efa-40d9-b677-a7be7376b574", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486078, "uuid": "e875215e-0263-4d03-87ac-223230fae6ff", "value": "dc81a0a5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e4f6f1e-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475368, "uuid": "91a54584-7a43-49a9-b871-150ca52fbf45", "comment": "Malware payload (Mirai)", "value": "e8f0f2f3746a2ee57b56785ad49b477b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475368, "uuid": "ee1f2ebd-30b6-4e85-80b8-725bc35facdc", "comment": "Malware payload (Mirai)", "value": "a4b949c08e49dbf350360f1a7d6ae317649eeaed4e4addfaf3a018855f5a7488", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475368, "uuid": "bcfad8d4-a433-469f-b39b-d250188db692", "comment": "Malware payload (Mirai)", "value": "85c96a2628032a72966e4c79b5820f1d444a77e5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475368, "uuid": "16130a09-bb2b-4fdf-836d-9dd8e4671b23", "comment": "Malware payload (Mirai)", "value": "6f8954d135c84c6fbcc14d9e9360089bae5a5a3a424ec8840bab5c57dd0e7b75dbfd1fee7cc3535dd7b3bb54c3d4ad9e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475368, "uuid": "68536b6a-aba8-46f7-99f3-0b7aeb172f46", "value": "A8A3B6092F218F7DFF9A423987B78E11965933AA3AE1C545D15CEE022E7034E341BFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475368, "uuid": "85b93544-c815-4947-accd-60d7e404362d", "value": "1536:sL4M1pRTj4/nrMF+n5WYEAhSAlpAMkf8lMGNe1B6cxI3H5d42+ca13/:AL1pqnr8+5WWSAlAb1B6cxI3TWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475368, "uuid": "cfd5b9cd-9ffa-43bb-b3e6-5a6570cb05aa", "value": 106296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475368, "uuid": "bf09fa72-98fa-46b8-abb3-f51679c5dfd5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475368, "uuid": "05520ce0-b358-44cf-8fe6-e56edd35bbc4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd1a163-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471686, "uuid": "27a205c3-e977-49ad-9ed2-7af3ac7fdb73", "comment": "Malware payload (Dridex)", "value": "5b9e4d1b21aa5212c79a2a23a9dbe7fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471686, "uuid": "6704e215-fc40-402b-a741-c231a07e92a3", "comment": "Malware payload (Dridex)", "value": "a4e05e7915a1b2b75f87974c45e360de67182c3145cee60c5d31ea8cf2624d04", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471686, "uuid": "a64bb456-33fc-4b1d-8db4-ebe373d6fe1e", "comment": "Malware payload (Dridex)", "value": "d42c396ee67c177ceaa2c529c2ef2945d232fee7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471686, "uuid": "f6659325-2919-4534-acee-60bf5a93571b", "comment": "Malware payload (Dridex)", "value": "daba788ca4064609107fd5358a7d8ee20e76cf83529b4560a63034ad9c696f35a129f9aebdbb5f77f2e191a83aa2340c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471686, "uuid": "c12401cd-e9d2-46e1-94a7-11199d291012", "value": "51F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471686, "uuid": "dc6d6117-e43d-4186-85fc-2fd6e19506f6", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471686, "uuid": "1ea35247-eff7-424d-bf1f-a1edda47cd28", "value": "3072:TuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:T0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471686, "uuid": "db553d30-d1d7-4a0e-be2c-b05a3415d5c0", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471686, "uuid": "e42ac1e4-4210-471f-b017-941f7d8392d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471686, "uuid": "c92c2b84-4d64-4911-bd42-1a6015476b75", "value": "5b9e4d1b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55815576-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620475380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "2141f07c-1c70-4283-a35d-d44fb297278a", "comment": "Malware payload", "value": "9051e655ac4af073362dc9f236458f80", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "202d5c27-1bd4-4e66-80eb-34d4fb0df4c9", "comment": "Malware payload", "value": "a54a95169e1e6cced3be3247f8fa0455f1034100446cfd1bb66d2830d1228c07", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "a59c654d-5dc4-4131-9cd2-8dc90201bcc2", "comment": "Malware payload", "value": "743067b404418ed415a40979db9c66fa0c94b1b4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "4a570103-6388-4fc8-aef1-a7f8b5cc643c", "comment": "Malware payload", "value": "e9296f1023baa13c70a71c084e5996821bb99f85a1755c4227182b3d7ff5fe8cbeb083c85a7becf9e18f9fb79e02c87d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "790cfc6a-6361-4955-8b6e-59ee91617704", "value": "45E2E138F2CD4DD4DD8EEAF18DE193E52B99CD0A354AD1963325DB248B837029280EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "2301c32c-ee3e-432b-b70d-9af708de94ac", "value": "768:/hECa/Zo6v2ZteEvbb893uUsqQlJc0x1OYo4uVcqgw02NWXUL1:ZEzZo6vstdv09rQRmYo4u+qgw06WX01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475380, "uuid": "97d00a69-5c33-4384-bca3-f3366c5c45ad", "value": 31856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475380, "uuid": "bb8b1ed6-e2a6-4efc-99f6-8ec11157b09d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "1eaf28ec-8371-4313-9f64-df7056bed470", "value": "POWERPC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2b4dfd-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442882, "uuid": "6486ba98-2085-499b-8aab-a065543ef090", "comment": "Malware payload (Dridex)", "value": "7e693f5b5ae360131d66f011397a7377", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442882, "uuid": "fcad58e7-035f-400e-a01a-061dd1c0cc3b", "comment": "Malware payload (Dridex)", "value": "a5c7281c974a1c026ac08f08bac5fe2eb989717d00c30e60b397ac46b14dbf64", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442882, "uuid": "6be429cb-eb60-430e-9803-b2ce2e478a47", "comment": "Malware payload (Dridex)", "value": "d921bbc121d426e5f70448855fc9aa40df4872aa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442882, "uuid": "4d1eda0a-efa7-474b-9c87-16373fc47bc5", "comment": "Malware payload (Dridex)", "value": "ba42693db80bbc3b1fe60112232bcb7742a10f14d1920d4a6e0a812cf9150cf613fda3beb13f81c6232afbe17553e14d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442882, "uuid": "5caaff00-1c55-4a92-8105-80477739e078", "value": "78F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442882, "uuid": "fae28a98-d6a4-4f9c-9df4-9b775ffe4280", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442882, "uuid": "646e507a-ee7b-41f5-993c-2927aa611011", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442882, "uuid": "cbfd7cac-b567-4e8c-a867-5ebe3dc0e98d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442882, "uuid": "680c5af9-e390-48b3-a2cc-aff1f8ac1ce7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442882, "uuid": "738cd64c-2f9e-4fa4-8bd0-6db5e15dc82b", "value": "7e693f5b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ff9e19-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432047, "uuid": "7e71beb6-23b1-4376-a052-9bfbd7f56951", "comment": "Malware payload (Dridex)", "value": "12cd9b2baa9227a7cca6dd77189ee7c7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432047, "uuid": "7ab7e6a4-bcda-4746-8837-d56db2979037", "comment": "Malware payload (Dridex)", "value": "a67ca0c1df8aa4afa70cb6a20635375c87ae85b419cd06ecdb8fae0c4467159f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432047, "uuid": "b0aeea66-56af-4163-9159-0ba7d8272f87", "comment": "Malware payload (Dridex)", "value": "141129a3e7cd262f7152923fe5b5af751c2e804b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432047, "uuid": "2bb38c5c-fa64-443d-a7a2-fdb18dad650e", "comment": "Malware payload (Dridex)", "value": "92b3db166bce3585575a6eb4562f684542f6611f36c1e9c07387e14f828ea6a066727af043e97bd322558859dba534c4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432047, "uuid": "13207687-3899-45ff-8f61-c51a9b23d060", "value": "5CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432047, "uuid": "fd01ef82-76ce-40b1-afca-078243ae2a66", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432047, "uuid": "66be1e51-a7e9-4af5-bfca-9e0ec8324368", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432047, "uuid": "bb3f9795-9d95-4706-9362-938a96e3b450", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432047, "uuid": "ebac2969-3203-47c8-adc1-9f38e449ec3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432047, "uuid": "953b198b-a11b-4c3c-bf1c-a28921ebd506", "value": "12cd9b2b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ffdcbd-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "3e10138f-ed78-420d-98d9-d9befd23c721", "comment": "Malware payload (Mirai)", "value": "fa42e558e95dd52cb7470c544f919285", "object_relation": "md5", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "779306f2-500b-41d5-87ab-b3685025d8c0", "comment": "Malware payload (Mirai)", "value": "a6cedde2864582c25d857e1c0b9a5ebe9c63af827002fffd361cea8da623f4a6", "object_relation": "sha256", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "a7607fb3-d33c-4520-8db2-6e6747ea5eb7", "comment": "Malware payload (Mirai)", "value": "7067ca8b9fea1ac6ad969cc7dc8b17101e858342", "object_relation": "sha1", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "835c21a5-9432-4c3d-ab7a-95f078c548d7", "comment": "Malware payload (Mirai)", "value": "48fb81690d9f1d84eea76719c1c50bef0692e041d275dc0aff06e8ff8cddce67242ecdc65e71399b6ab038563a8fee3f", "object_relation": "sha3-384", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "3c8e4bff-e4fc-4948-9e10-5f433ee0c214", "value": "BED2E1A6819C4870CE344DF2D834868B4E9213F5D2F2387627919D5CFE4C45AAF7A4E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "5db3623c-e8b7-41da-a648-b2d139740de2", "value": "768:LGDEIWIx066PJ6aJFM32viQutCae/CXIdZkMk+AgCWA2UtKs3Uoz+G/:6QJK06eJbJFMGqQu+/CXIHkMnCWAtz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475384, "uuid": "c8a2f7dd-2d68-42f3-b27f-051b11d5b1e4", "value": 29632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475384, "uuid": "89b413a5-0861-4aff-9df5-696ba0e2a5db", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "20aed932-3d13-4220-a934-0c26b15905b0", "value": "xd.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13bdadb8-afff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Heodo)", "timestamp": 1620479564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479564, "uuid": "cb115c78-2ccb-4efc-9d88-29b4342edffb", "comment": "Malware payload (Heodo)", "value": "3086634eae7227bf02194ff41425285b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479564, "uuid": "df5dfceb-4a2c-49cc-83d3-6e12543e24bc", "comment": "Malware payload (Heodo)", "value": "a6d1ddce9ba33a244313f7e06fc432276d07f5757c7677b144399061ad6dd90a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479564, "uuid": "516fcc10-663d-47d6-80d0-30bd02ccdc12", "comment": "Malware payload (Heodo)", "value": "2ffa9a150bdf381d85a8329da0bf738b9d6b7070", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479564, "uuid": "b722eab8-41f0-42ed-a816-83f50adcbec6", "comment": "Malware payload (Heodo)", "value": "3fc960467f67a80e1892e98db318e9e603da98a9e3328a40e16b409e4f657443e8cf34667b45e41accd4db44759baf47", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479564, "uuid": "6e98e297-59e7-4b60-9ad5-557622fb9b4c", "value": "85B41212739F83A2DAA4A17245EF725003F1AFD71637B58D3FC8124C5A513639EA3E29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479564, "uuid": "8f0a482b-8f78-4a82-8b88-64471c22ae03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479564, "uuid": "a02bba15-548c-4d45-a604-710a54cc6231", "value": "12288:FQ0MbRzbXvUrI/Ruw4LjS2kAB2WlbRBx9iI7CsvO:FQ9d/M85u7LjK+lNBi4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620479564, "uuid": "17aa5d50-5925-46c3-970b-97f791f28cc9", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620479564, "uuid": "7c5e2522-7f92-4bf8-86f2-d26f1c52768f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479564, "uuid": "ea440837-7be2-4796-8487-81949f3b2df6", "value": "samp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4295b5c2-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468046, "uuid": "c72c508d-9de2-4cee-a2f1-b59be760bddd", "comment": "Malware payload (Dridex)", "value": "225963f5bebb28dfb7e33bae209fbac1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468046, "uuid": "f88a59f4-7318-4f40-a422-2d6699cb3d5c", "comment": "Malware payload (Dridex)", "value": "a7418fa2d7ce8b99e07db27308fcc79fcd83fdf406972db465dd3f3903eadc4f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468046, "uuid": "0784218a-5e21-41c6-821f-e4ecacd31677", "comment": "Malware payload (Dridex)", "value": "c0cba49d549e1c10996bf878ecf4e3675785cc59", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468046, "uuid": "956fdedc-63db-4c4b-ae1f-7d3d6c2dbd7e", "comment": "Malware payload (Dridex)", "value": "809099d336c662483cdc5dd0862e8f73a7124188c10617b7ab8793ece3691b3aa6e85fc54ecf3404a6d0a49cc3e8d0ba", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468046, "uuid": "c9d65400-4043-490d-8416-89d3152f0dca", "value": "F8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468046, "uuid": "7472a805-65df-4adf-ba40-93387412fcd9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468046, "uuid": "f904f89f-f321-440f-b64f-debf155f8cb6", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468046, "uuid": "88e37f47-7138-4e60-839e-756c7233ca21", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468046, "uuid": "d097b738-8691-4151-8cae-6e5f25a25fb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468046, "uuid": "1c8e888c-eb13-469a-87be-a5540916b528", "value": "225963f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba9e79d-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442829, "uuid": "eb873d81-b0c2-42a2-81c0-9da87b6d1a9b", "comment": "Malware payload (Dridex)", "value": "7c364f56892d2b4f8b22fdd279f1b03d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442829, "uuid": "6ad8946f-06df-4f0e-8446-227184d7a1cc", "comment": "Malware payload (Dridex)", "value": "a7b50e3d846b3a0a8e2495ba57733ed7f25d0473a157bb7dff68b17026ea16a3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442829, "uuid": "0f74c66d-bb39-4c61-b925-d3885ba110e8", "comment": "Malware payload (Dridex)", "value": "79e93ba111cb97c76b1e5acd7f65d71926fd95e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442829, "uuid": "9e906061-925f-46f7-a4c3-bc08658e3cd9", "comment": "Malware payload (Dridex)", "value": "32f7489a7a7144a723821676f4b921387e86cd376dd29e8192be343e50426d014a642c70b12235a553a3cf1afc7089bf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442829, "uuid": "314113d8-6560-4905-9eec-d940461f63a6", "value": "6AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442829, "uuid": "8615db28-c87e-4396-bb80-45b83f3888b6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442829, "uuid": "1a324cdd-f851-421d-ab88-4dd4e9e7954e", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442829, "uuid": "975da0ae-075f-429a-a403-0a50056c31ed", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442829, "uuid": "598f007d-0c84-49f2-bda8-63bf3fa44c4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442829, "uuid": "6047090e-4a13-461f-8e35-6000663665bf", "value": "7c364f56_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561ce358-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "8665f134-cbca-4959-9114-2e73a742a036", "comment": "Malware payload (Mirai)", "value": "66457faf9f44a3e09a4bce59f91e4c84", "object_relation": "md5", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "7fe42087-0a1d-4d1d-add9-fc24b9d21cc1", "comment": "Malware payload (Mirai)", "value": "a7e32dcea79d674242fe930df6dd42c74bb78376fbbfb05f2ce10b6bf3cee99c", "object_relation": "sha256", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "8d59608e-211c-4e20-a520-f3ff286624e1", "comment": "Malware payload (Mirai)", "value": "1ebe4aff251dd7a44c871d6dccfe035b34f40d3b", "object_relation": "sha1", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "cf03eaa5-6e18-4d9e-86e6-0be146c91912", "comment": "Malware payload (Mirai)", "value": "ef2469236e5392301ff09bd2cdb0b9de087242ba8c9d656cb45844b4c8775955fed2895af81b4a9eb0d92a947d21e701", "object_relation": "sha3-384", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "15118433-c119-4c4b-8c36-d416e3d05aaf", "value": "4143F955B8818A12C5E413BEFE2D018D33136778E2DFB2129D116F1477CA92F0E7BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "608cb4b6-e286-4e29-854c-7b8277a5e0a1", "value": "1536:wdnv0X/W0JHdHSSkVsl2H44crEj2fNyLwwIQiBg/eQ4+:DPWQ9Hdku2HFcoqD3g/eQ4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475381, "uuid": "26b74732-3999-453b-968b-0a9f9b585af0", "value": 58496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475381, "uuid": "2185485f-bb6f-4c95-ace3-8ad4854d88f7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "b6d0891c-de9a-45f1-b887-a5c0ec12e2bc", "value": "Winbox.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e2f8ce-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489683, "uuid": "f6eafc98-8492-48c8-b2ac-e46aabece871", "comment": "Malware payload (Dridex)", "value": "6bbae39c5f50caa182aae31b37faa09d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489683, "uuid": "1932a9ed-edb3-4f63-aa68-d6622c6037f6", "comment": "Malware payload (Dridex)", "value": "a89a870762f42c10dc1928f30158630e19cbaf7905abd77d338de3432c785de6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489683, "uuid": "695469f1-f6a5-4b7f-81d3-2086205b604b", "comment": "Malware payload (Dridex)", "value": "b3e93ab3633ff474724fd22ce9ea738c651ed2e8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489683, "uuid": "89f570f7-89dd-4fda-ba13-501c654afad8", "comment": "Malware payload (Dridex)", "value": "d4a386dc0d5548bbb89a62cb3b67910b201dc01f2994e8ab4f881cfed89bb905ff8c5d5c35910bdb0e2f773a83445345", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489683, "uuid": "5cbd3083-d03a-40cb-8b0d-8a9f2b279f5c", "value": "11F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489683, "uuid": "14b5b66e-e040-4441-84e4-9928107482bd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489683, "uuid": "a778d66f-76cd-486f-83ab-b18d66c1de8b", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489683, "uuid": "a13e37a6-8be8-483b-b878-d3466223a3c4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489683, "uuid": "cd6e3fdd-0550-4077-8c60-a97258ca741d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489683, "uuid": "748e1ea7-e64d-480b-b151-cdf5fa5eaabd", "value": "6bbae39c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25e275e-b01f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493601, "uuid": "b33a60bf-b886-4d2f-bdcb-789e68d5c4c4", "comment": "Malware payload (Dridex)", "value": "918fcf41dd5ed77168681ca6202a77b6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493601, "uuid": "88f67ace-226b-448c-911d-a2fe60f3d9d9", "comment": "Malware payload (Dridex)", "value": "a90f861b8f1497d7d567585565cdb1a23c95c72663720bc88d3957b87713c11e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493601, "uuid": "e450642d-31b0-4e01-90a2-d06a7d634c8d", "comment": "Malware payload (Dridex)", "value": "1b746e366658279143533225fd62fd96396b5f43", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493601, "uuid": "1a39f2e1-d9e2-4ae7-9224-9eb10bbd29c7", "comment": "Malware payload (Dridex)", "value": "56b30a9e609ab163ebb41970967e953eafed731b82fd3448e6c533f05d86b2c092fbb6f9cbd2c5363d82bd1870364d5d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493601, "uuid": "e9e35b44-dd85-43d3-8dc2-704589b592f1", "value": "72F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493601, "uuid": "e9ed0026-b3c3-41d1-95a2-6b3ce5367ed3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493601, "uuid": "a61f6bf7-7734-4141-bda9-3382584e9b77", "value": "3072:YIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Rc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493601, "uuid": "4c332316-d74c-4431-876d-0795194cb133", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493601, "uuid": "86461c6f-b1e2-49e0-9e9d-239494a7c854", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493601, "uuid": "36626f5f-70c8-45d1-b2d5-921b2872d034", "value": "918fcf41_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df6c25e-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468039, "uuid": "622601a8-f8d6-4350-ad2c-135c175cb41a", "comment": "Malware payload (Dridex)", "value": "e9cb9025cd3fc93958466f0e7e388cf3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468039, "uuid": "360a0842-75cc-4237-afc8-a8a65d3f2f37", "comment": "Malware payload (Dridex)", "value": "a9aee51a3676970249fc74870d66253c413e725db58c0bb04b7a44318f847383", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468039, "uuid": "8873babe-1c83-4a6f-b523-c7d8788c3356", "comment": "Malware payload (Dridex)", "value": "7d5beff7a79239a8bb807a28d9174b1575611277", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468039, "uuid": "efd6648e-7286-4223-88ec-8bc97d55d98e", "comment": "Malware payload (Dridex)", "value": "337223d10fe86f15ed19de859e142f6e2074af669da7b7f15a2f91feeb8351425692b719cbf29b0025b8129d3fbc44e1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468039, "uuid": "c18f71d8-b2ff-438e-ad0b-604ae32bc328", "value": "7DF3C141C9C5CCF0CBE36C3A4695963B3228B541995A8E42EC64CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468039, "uuid": "93c6da6f-ac4b-4056-b311-1797f02874e7", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468039, "uuid": "77c98dfa-ba3d-434f-992e-a5676ae6bbbd", "value": "3072:9uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+HY:90czbty9uiaJlOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468039, "uuid": "23ac795e-d17e-42eb-b3fa-f3c3f9bf3a47", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468039, "uuid": "aeb43c59-4767-468c-ab78-10b2ac6d56d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468039, "uuid": "87a49dba-518b-48ca-ad33-aaffbc136328", "value": "e9cb9025_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3df076c-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442869, "uuid": "db3d49e5-0e45-4842-bc52-8d538e464e21", "comment": "Malware payload (Dridex)", "value": "5afd97319cdada9e62ba13e8e8589896", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442869, "uuid": "ea77c8cd-1c15-453e-9bc9-f5aebf7193c4", "comment": "Malware payload (Dridex)", "value": "aa12573682b02cda003283d47edc326593e0b97a7f20cbca6239bedbd949a47e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442869, "uuid": "84f53b1e-73ac-4b04-8de7-6054a981d66d", "comment": "Malware payload (Dridex)", "value": "3e47d4e7794f5e5f4fbaed45e5fbef1f0ecf2f13", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442869, "uuid": "504ea155-06be-4172-a19d-50d1925a1188", "comment": "Malware payload (Dridex)", "value": "67ad790e1cdb58bc807c4ecf344f37365ffe794c389cae060fd6c6f9804046daf8d786316e173af1c9f588c9d93babc0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442869, "uuid": "7b7574a5-ac58-4878-ba38-721382945294", "value": "A3F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442869, "uuid": "5002fa73-16d4-455a-997e-7d8c43d2a913", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442869, "uuid": "c7188350-9f02-43e9-9457-913a05247fae", "value": "3072:GA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:G3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442869, "uuid": "aabedb4c-7100-467a-9374-f2246e522d3a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442869, "uuid": "2869b9ca-6bbd-4c77-a311-5c0b5c257a17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442869, "uuid": "305fab2d-1c7d-4313-87db-b07aa49280d0", "value": "5afd9731_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1caee425-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620475284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475284, "uuid": "a4d3c214-9216-4e75-a08f-53bd2f4e89da", "comment": "Malware payload", "value": "d3959257808eef5fe46a4a7de051bd7d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475284, "uuid": "bf0dfaa7-272b-44a4-9406-7c81a3d3990e", "comment": "Malware payload", "value": "aa84e002d82beb87d2970c2a7223f9cb0337e4200e91fffc0636a29ecfa3293c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475284, "uuid": "cadf1ec2-dbd4-4604-8149-8414ee0c346a", "comment": "Malware payload", "value": "033c42296691ea32fa194837e105c9149738e106", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475284, "uuid": "2fceb6ae-d22f-4b0e-b133-8d3ef7d5dae4", "comment": "Malware payload", "value": "e224e726623bdd0dc15326f52fd8263363ed8c54a0e4cf5082c9104273a0179f92806982766f1116e0e9147ac1d24e5f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475284, "uuid": "9a26b676-c025-4e59-b80c-c689fa532c88", "value": "42C312DBCD84C25D3E7A312D63D6B8722E37A366D89CA1D789FE210565303E0629CF51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475284, "uuid": "0ebe18f5-39d6-4564-bca5-8dd07897d493", "value": "3072:B20D9/vxicG8pDzbBX8lXZEKN5yFIWBdoF/3POumewxA4hCXe:B2W9/v3RDvBsrEaEBdoFvPOgw5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475284, "uuid": "b7d6c4b2-d522-4076-a0e6-240541ee6ccf", "value": 129265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475284, "uuid": "b851804b-7cac-4137-8cdc-6870cd4994ab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475284, "uuid": "4bcbbd9d-0ee1-4f9b-a434-2d790629eea6", "value": "d3959257_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12246ec-afdb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620464420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464420, "uuid": "274c5b57-4885-4403-99ec-0ddc05f92d6e", "comment": "Malware payload (AsyncRAT)", "value": "ace7c01a3c368fe5377a730473459bf6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464420, "uuid": "3da07262-b46b-4222-8ea0-2495c05d25ca", "comment": "Malware payload (AsyncRAT)", "value": "aab31adf2a159b146b4350f6da6ffac698206e596b18c43dad16a4891c2eedb9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464420, "uuid": "09354802-b855-43c9-a420-0b49e5479c3e", "comment": "Malware payload (AsyncRAT)", "value": "eedabf9db6b27737c27b90f3b1f23b2e0414e391", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464420, "uuid": "7d4c7ede-f78f-4ee5-bf51-e2df70db7654", "comment": "Malware payload (AsyncRAT)", "value": "6de3d2ece5a2c7989e2ee9f1a9906dc564a3b2db7d5f81162fce5675654c59ef50fe9f781d112fb6e7e12836212d5d90", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464420, "uuid": "75a1e156-4a65-4fbf-82de-8c36c7d3f484", "value": "3023190037E8812BF2BE4F78A9F26145867AF2673603E54D2CC451DB5613FC69642AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464420, "uuid": "f62663ef-3d79-4be7-acd6-cfad346f6d09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464420, "uuid": "f05067bb-3f56-4f43-8c1c-a0aa920851ca", "value": "768:MuwCfTg46YbWUn8jjmo2qrbcg1JXnWNLPIE4zjbWgX3i+rTzJ2vGzBDZSx:MuwCfTgp/2AcqWCE43bJXSKJ2+dSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464420, "uuid": "21cb3b67-b65a-4bb9-a2c9-7f9090f88ba5", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464420, "uuid": "e49c1e17-6d9c-4b59-9e33-186221387942", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464420, "uuid": "dec9f57d-843d-49d0-840a-6cb1d283fd2a", "value": "ace7c01a3c368fe5377a730473459bf6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15576c13-aff7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Pony)", "timestamp": 1620476131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620476131, "uuid": "671bf215-eedb-4b0c-9581-8e580cdeaf6f", "comment": "Malware payload (Pony)", "value": "fd442753c3895d868eed72f7854e2fba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620476131, "uuid": "2d7b7e09-3310-4675-b6a6-6bc565c4b6c3", "comment": "Malware payload (Pony)", "value": "aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620476131, "uuid": "1ef5cd79-86aa-459c-8394-88318b6f5713", "comment": "Malware payload (Pony)", "value": "477dc12f213dd05a15b61207926b478d3a0d04c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620476131, "uuid": "8c06a823-465f-44d3-90d6-df16df46a8d0", "comment": "Malware payload (Pony)", "value": "3d47433695b1421bd7dd6f5b782aca475af99e02b2e55cacd553c5b17321146222db748c8c3c404c0801357c7d49d161", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620476131, "uuid": "6c6179fd-32ec-4da0-8d8b-c1a99286b84a", "value": "8EA41222FBD285F6E096027149922BA982BDD6BD032DCCC35B984D459FA4DD6D33F207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620476131, "uuid": "314f252c-af25-46fd-8638-a3c6007e825a", "value": "1d1577d864d2da06952f7affd8635371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620476131, "uuid": "0df66490-7d32-4aad-9a37-c88358d1a10e", "value": "12288:ZAHiKgHgZ1mWryniKSojf0hxZnLBEWYWGS0C89BzI:ZACKRZEZn3xLUuWYVSI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620476131, "uuid": "cecf802c-78c0-46ba-98af-3bab6a417901", "value": 455338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620476131, "uuid": "c870a710-2961-4f19-85cb-529f7e2a5d12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620476131, "uuid": "6eedb466-dbcf-4ff3-9b00-2ddfcb93e613", "value": "AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a04343-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468053, "uuid": "14b803c9-250a-4eaf-9add-8f378da6765d", "comment": "Malware payload (Dridex)", "value": "bafd6c061194e3d59ac94c42a2ce5e39", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468053, "uuid": "06e2db79-d80e-4562-b6b5-8e2bdfd32ba8", "comment": "Malware payload (Dridex)", "value": "ab371601637adaa7fb00c82aa4b842932a49c0cef2a3bca8e331a56fe7898b5f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468053, "uuid": "e8e603d3-3630-47c7-8fa7-dd70cd551fcb", "comment": "Malware payload (Dridex)", "value": "5808ac388de0f335053edb16f43381478b67aba0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468053, "uuid": "d1afd7ea-b794-45d7-ad5c-7194bb72f078", "comment": "Malware payload (Dridex)", "value": "fdfa702e70e6894b04bc1cc0b6b2d479715bfee0637b171e049aaf7c11517f32756d7f1f1bae3457b2586c1c12899f6e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468053, "uuid": "1605583b-6019-4921-a82a-e4e9fe6cd980", "value": "0AF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468053, "uuid": "fc0ef8a1-f668-4226-a0c3-fde59b92432e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468053, "uuid": "27d9fcad-dedc-498c-8f46-3e8f0b4f23ca", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468053, "uuid": "be44f65f-fdbf-4021-b689-9fccf75719fb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468053, "uuid": "49196998-3561-45e1-910c-29518f4013f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468053, "uuid": "9624421c-8379-4626-a3e4-91119256078d", "value": "bafd6c06_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553fda8e-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "0af25636-1fcf-45c2-960d-8efde4906bc0", "comment": "Malware payload (Mirai)", "value": "bf2883241b028b85511ea73f42699c7a", "object_relation": "md5", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "cf12f5c5-654b-4880-a327-cad634c80002", "comment": "Malware payload (Mirai)", "value": "abd03b11d9d570402e882a8abaa05950fd231ffe7d355f29383734ee4fe8a056", "object_relation": "sha256", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "d98091eb-ba34-4a00-8aa0-5adebd469682", "comment": "Malware payload (Mirai)", "value": "1475cbf25e5ecfb1c7ecffc10476e3536a0baa27", "object_relation": "sha1", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "3c48cae7-0565-4009-bd4b-747bfc79933e", "comment": "Malware payload (Mirai)", "value": "38b8f70e758c74fd507437b9aac51698e48200c38a20fdcc626269e3d680b7dc0b30bf7dfe107dd576d47a4e23aa5314", "object_relation": "sha3-384", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475379, "uuid": "d5c06f85-498e-4216-b03f-d98be0551321", "value": "D3831981B9809E15C6C5177BFA6F108D331247A9E2DEB353CD145F6477CA82B0E37A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475379, "uuid": "868f2024-1f99-440f-92fd-605b537ff352", "value": "1536:29n7/xkRBFg3yFhk20WtEu+1F4YPjaduBcPYO9mrsplDKZUlQBKXAVan1X+F8JyY:gJTyHknWt/+L4qjmugd9mrsplDKZUlQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475379, "uuid": "252de874-4f92-467e-8bb6-deed74a25a0c", "value": 83072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475379, "uuid": "3ebeca7c-7319-42e0-8be1-fb28fc55d533", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475379, "uuid": "c70d166d-8bf9-4d81-a794-d7c99bdb5591", "value": "loligang.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a59712-afdb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464461, "uuid": "1e68aedc-69c6-4454-91f0-a55b229a779b", "comment": "Malware payload (Dridex)", "value": "2e75326242f3c750a67eaffeb2fe65df", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464461, "uuid": "3999af1b-d8f8-4f8f-a682-b1a6915a673b", "comment": "Malware payload (Dridex)", "value": "ac0e5c4dcc2b81c42069af107a18388d51a65717c5ace72cced02589775a9a64", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464461, "uuid": "8ebc673c-58ce-4821-849b-e4ad3d3b5c1d", "comment": "Malware payload (Dridex)", "value": "dcc97fd3a35288b7d891214082cf270ccbb4f860", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464461, "uuid": "83dbe7a4-f284-4917-9593-c3e711b637bc", "comment": "Malware payload (Dridex)", "value": "368f7e5d7a4cc9df2bf00b0bd148e0f7b50bd8546dde291f98d073611c1937f4623e0ddd92edef1c965e6de0ea6911c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464461, "uuid": "0f02c627-8d6b-44c3-96e7-eaf8216a163d", "value": "B5F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464461, "uuid": "605bae2f-f249-40f7-9a87-4efb6e8cf141", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464461, "uuid": "2e071c86-7b33-4771-a27d-8eab35f176d9", "value": "3072:5WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:542IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464461, "uuid": "7c5ad992-cac5-4882-aa50-8cc7d919b6d0", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464461, "uuid": "f82ec2a7-1a8b-4264-98d3-e00063c70232", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464461, "uuid": "69c89d13-acd0-4f2a-880e-809850755601", "value": "2e753262_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dedb7a1-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489675, "uuid": "0a53db75-5a25-4d47-b59c-94a8023ecc57", "comment": "Malware payload (Dridex)", "value": "1b346c2500e79b16ed23e07bc71c1739", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489675, "uuid": "6238d5c8-82ae-4859-9daa-724cf3749605", "comment": "Malware payload (Dridex)", "value": "ac5199abc0d8214303d0df3b3a7d44d28ccb99f197dba9b50b831295d5c7df45", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489675, "uuid": "d7d0200b-1404-478e-a96f-3ca4a2c9de2f", "comment": "Malware payload (Dridex)", "value": "4095b259c2e1736c4fce7dab676fc199df12fcaf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489675, "uuid": "b4f47b29-b0dd-493f-9a15-5eda3b0ccdbd", "comment": "Malware payload (Dridex)", "value": "40d87baa77679c58ec9b5f60e9aa34717d6f7053df4eeeefe7187b188b84c937eef6913a3f3c6744ab81bb4e79f11b14", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489675, "uuid": "55d19262-ed1e-4181-b4e5-0659b6e51c47", "value": "D1F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489675, "uuid": "352821a8-1071-4620-9c6f-71e7f41e0ddd", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489675, "uuid": "a9edeb94-d01a-4abc-a269-802f7b5a6e78", "value": "3072:ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489675, "uuid": "d70e39d8-72b5-4030-81b0-c233a130a524", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489675, "uuid": "19310b12-121e-4513-9d60-a5231d3a5b40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489675, "uuid": "eb3b6624-fa75-493d-a332-612ee024f2fe", "value": "1b346c25_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ab0fe3-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620475377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475377, "uuid": "af329d5f-1f4c-4242-885a-1a63b800b958", "comment": "Malware payload", "value": "3024ffb92f532bf2b21f410124a8d832", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475377, "uuid": "3428c665-148f-42e7-b2d2-1d2fc9621d1e", "comment": "Malware payload", "value": "ac9b01e94930a001217d3809bdad4c5f1363706f94dfcac5bb87fe70f3699567", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475377, "uuid": "79b6c993-c967-474b-bc3a-95ee6b657688", "comment": "Malware payload", "value": "0f13b2e498a71d8cad6c54fade1507714e3e8fb8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475377, "uuid": "b51f9cf6-cc9b-4f8c-9f7a-216687c0cf95", "comment": "Malware payload", "value": "2cd2f625c4e957e52b142f2760709c7cff375c7fb4d4c5b25c4d95fd9edd37b7cc718f11048b57113e3a33ffa00cda76", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475377, "uuid": "bfae4037-cd6e-4cd9-b8d4-d3c328599e03", "value": "5CC3F747EB781EBBC88FDE37019A0749219E565221547F3A75B9C138FA8E14B0EC3E64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475377, "uuid": "bd7eb70c-db44-4694-89dc-079693f666df", "value": "1536:5N5x9qwcdYDg+6ghRfN/CXMPxZ9b88u9r5gviyTP4:Zqw3Dr/CXSGtUTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475377, "uuid": "14ff7e6e-7efa-4f02-ab5c-4295ed353d45", "value": 118268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475377, "uuid": "0ede485c-4e61-474e-af58-0a8d41bcc3d8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475377, "uuid": "54e15386-a381-468c-9a34-c1902e3eb78a", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2c9868-aff4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475235, "uuid": "c271b6c1-c35e-4cae-8144-5995c1ef54fc", "comment": "Malware payload (Dridex)", "value": "fb91f453ed3c84f7465512087af69ef8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475235, "uuid": "b92747cc-5f38-4e45-a523-9ff0c292bf74", "comment": "Malware payload (Dridex)", "value": "acbe84ff3a7054504a503e1ab506112dfa00a8b3ce9c26c455c880b544b60002", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475235, "uuid": "fa27b3e5-f30a-4583-a3b2-228eee903a34", "comment": "Malware payload (Dridex)", "value": "1cf5c0a1f5af1c91a152fa0463df2cb07be94e98", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475235, "uuid": "424a1c33-f0a2-4a1a-a257-3a0b32c1f161", "comment": "Malware payload (Dridex)", "value": "f6fb889a839f843e5b73cab4d100dee05b7073bc7e7506daf9fd4678a54011514d0e59b072545489942ed1e7c0f9ea36", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475235, "uuid": "1ad9fe75-7bd0-47dd-8ddd-4f3f59d63ff4", "value": "1EF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475235, "uuid": "d66dfe70-1242-4235-a0d1-0037d7ea8f6c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475235, "uuid": "2e1c121f-a81b-4467-8d9b-3ed8cb72593e", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475235, "uuid": "db7dd289-f58e-4346-b892-301b8c6a5464", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475235, "uuid": "cc9b7207-0f4e-4074-84da-87b535b7ac63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475235, "uuid": "807e09c0-8d83-4e2a-b8c5-9d4e33fdba50", "value": "fb91f453_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5793bdf8-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "4bce2d45-39a6-43ee-a1c4-169ae71335e6", "comment": "Malware payload (Mirai)", "value": "9e1072cf367ab6afb66b25bf956632a5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "b73180d9-ae5d-4db0-9a8d-28dad2c9d3c6", "comment": "Malware payload (Mirai)", "value": "ade2fd6a7a63ce7530769ad4149646a5d0bf6cfc78956fc98c9977cc9dd6e4d7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "3f8b9e9a-2030-42fb-9fa4-ebb0b829a741", "comment": "Malware payload (Mirai)", "value": "1118d317f8dc72e070055f3af1e322f07bcb8587", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "7c4e0908-51f1-4adb-829d-9ea00b6751ba", "comment": "Malware payload (Mirai)", "value": "bb6f7a79f966296086200679ac6bff06b8989e72de9dca6f9437d0fb40609d35d0e66ea64f1953f2c45cfa9050ff3016", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "d785e23a-3d68-4a31-9fd4-0a347e69b514", "value": "0C934C24A9392F23C0C4A57A11FB8751F6E5368F22B4965E7CB20F4FFF106406946AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "87fd0dac-5dcf-4ab4-bf10-2273650f5786", "value": "1536:zpSaRRDjSn/Px984pUDRJRD1bDR3P6+hdcyx61ITXjAvbRKTUbdrIFhW:8abWR9Z4bhP3hdc1jvbYgJr0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475383, "uuid": "6e7a0092-75b5-47f3-b268-d4a263de3b85", "value": 93968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475383, "uuid": "5b822e69-a631-430a-b3d8-3188f7f3bb94", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "cd2e1b14-139e-4fd4-9d27-147b0d7f164f", "value": "xd(1).spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525a6229-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "80c5fa10-cf5e-4fe4-b3d3-5127e4789cfc", "comment": "Malware payload (Mirai)", "value": "d0581f69683111c9f21d18151f15e0e1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "020251e3-380a-45fe-84ab-6c1b13444d05", "comment": "Malware payload (Mirai)", "value": "aebf23e5bbda598d5a0f8afa6e8a084a19f83f2b20730271557546db3d975ae4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "76be6084-947b-4ef0-9224-342675359037", "comment": "Malware payload (Mirai)", "value": "b51199b947f1274430bde1bd40d1986339ef9bc5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "d3aba47d-9b7f-4c18-8ef8-93d5bb702d75", "comment": "Malware payload (Mirai)", "value": "e685baa409dcbd00f3f37e7755d14bc4dd2f51dce1f45aa08250c0f937f00870bacaf8bbc3a0a0017c9b4e2bcffd0466", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475374, "uuid": "e95efc6e-fc85-456c-935b-3fe57f9e8aee", "value": "FD93800AAF611FF7E89EDC374AD92B0524DD511A20AD7B39B930D818F25B30F19E3865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475374, "uuid": "338f82e8-db2b-42c8-a4aa-03c3f01a09c8", "value": "1536:NYCYxrXP40ODyPwHRQ9PlzTRfyToNoZqdi:qCYxrKDy46N2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475374, "uuid": "7227057b-4654-4295-83c2-8faf28a9a383", "value": 92100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475374, "uuid": "143ab776-9f5e-4b77-b288-f4edcc4bdd78", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475374, "uuid": "59fa4b71-af9b-4985-bdf8-9021e5a1ae48", "value": "loligang.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1585587c-afdc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464535, "uuid": "68973235-c7b0-4c59-b92d-06d726a5a874", "comment": "Malware payload (Dridex)", "value": "a71f50a692c9b49171cba2ec86fad4df", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464535, "uuid": "d6cd8687-b5a5-468c-b3db-59d6cbe8f9e3", "comment": "Malware payload (Dridex)", "value": "af8dfa2999d566a6f28e9e57b0d87a2c7f23dcaffcf2f04c9ba17c8b675cc730", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464535, "uuid": "e6a4e882-8ae5-48b7-ab69-570c3720c059", "comment": "Malware payload (Dridex)", "value": "0ca5a0979d9343c9c04a260184c59df6416b06c5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464535, "uuid": "a6fb81b2-c06e-4b6f-bfd9-cca8991be44a", "comment": "Malware payload (Dridex)", "value": "4cc88453413b917caca1225bdd5a2b9b795cbfa60bd547f139dc9049dd6b1f4a49c203714cc5bd8b1707bdd490fb0736", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464535, "uuid": "f202df33-8c9b-45a1-b818-5cfcadf5040b", "value": "85F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464535, "uuid": "35270ef2-c7bf-4c73-8911-27a8e6bb97b9", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464535, "uuid": "01b0808e-56f4-44d5-a47e-547cff421f57", "value": "3072:WWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:W42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464535, "uuid": "aa653692-41b1-4748-8c9f-339317477099", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464535, "uuid": "7da308bc-78a5-44bc-92a8-2d2eae99c6ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464535, "uuid": "bc6fd6a7-96cb-4ab3-8e14-a9886f515692", "value": "a71f50a6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3787de74-affc-11eb-abe1-42010a9c0039", "comment": "Malware payload (YoungLotus)", "timestamp": 1620478336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478336, "uuid": "27c1ec9a-7355-41ab-90e3-1a93a09df1d5", "comment": "Malware payload (YoungLotus)", "value": "bb56f20a2a0dec07dcde2cd7abf75eaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478336, "uuid": "49075b2d-1c82-495c-be5e-fb607b8a5e00", "comment": "Malware payload (YoungLotus)", "value": "b01719e59675236df1a0e1a78cdd97455c0cf18426c7ec0f52df1f3a78209f65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478336, "uuid": "819b7702-09db-4d52-85a7-f2a1559eae11", "comment": "Malware payload (YoungLotus)", "value": "9214afaf9966aa452385f8b454990b3b23ed110b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478336, "uuid": "f092db55-5e3b-4706-b57e-cfa30aac5afd", "comment": "Malware payload (YoungLotus)", "value": "25a86be07a00a3cba1eb026c12315c397caab6950a6ddeb767091740d8e04489a6fffe2239d45cc786ef4887ea1b9596", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478336, "uuid": "77c7715f-e364-424e-bb12-84f1a16aee3a", "value": "AFE4AF123283C03ED57711728AAB826D7276FE100B2996D363C47B6E5E785F27F36126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478336, "uuid": "bac32440-84dc-44c9-8c1f-a11e6f60ff11", "value": "219e16fcc9bee3c339e320279e3ea7b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478336, "uuid": "e2bb29e9-88bf-4173-a0d1-8d6da9eb64e9", "value": "12288:MPP4xa0NIIwpaBLOyEJN8E555pb9drYxtpKw:Rxa0dwpafEJN8Ez5pDrYtcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478336, "uuid": "b307b381-2ff0-46b0-ad50-1c470ea04c7f", "value": 719703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478336, "uuid": "ac241fcd-3714-490d-a0a3-88b1bfa4f2ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478336, "uuid": "1b85f4cb-109b-4bb1-ae81-720c6442b055", "value": "\u4e2d\u4e13\u5973\u751f\u5b9e\u4e60\u671f\u95f4\u88ab\u5f3a\u5978\u89c6\u9891.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce675e71-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435639, "uuid": "293af13b-4fc7-413b-a591-12aa17d62d5f", "comment": "Malware payload (Dridex)", "value": "4497995d0d3a3d0fffe6c9a7b9162787", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435639, "uuid": "2b1d9997-4eb8-41a7-a4ea-e46ab84fd0b3", "comment": "Malware payload (Dridex)", "value": "b0a0d8b153274dfd7f1f79c0a97c04f2e77794c0e9d5a72c5628b3df11c5cb49", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435639, "uuid": "bd8eb24b-5b37-499f-b5c1-43d98ae2c25c", "comment": "Malware payload (Dridex)", "value": "d990fc592dd6d5996887eba6e2621e31df84aef2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435639, "uuid": "b224f8fd-76ba-4e5c-8cfc-bff62f14801c", "comment": "Malware payload (Dridex)", "value": "ceeb3fc6291ef8e307dee81a889f6ef6bbf5229c499b40a91b12353fc695b3a5e2053f3e0bed52922a2afa0ea81bd61e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435639, "uuid": "743eb9f8-e91e-4685-9c1e-80ad5c8ca24f", "value": "FCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435639, "uuid": "f0019c93-6620-40cd-b347-f9cca13baca5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435639, "uuid": "790612ad-43e2-481b-883f-8644f5063118", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435639, "uuid": "602f54ef-85c9-4cdc-a10f-79feffb14d5a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435639, "uuid": "1090b22a-8931-4724-9f2a-5e94cd02d2d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435639, "uuid": "947bcbc0-a10d-4fb0-b965-bec150a9f91a", "value": "4497995d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdd620c-b006-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482586, "uuid": "fc15c53e-f22c-4460-a665-8dd851f9ee6f", "comment": "Malware payload (Dridex)", "value": "990cf0d341ec7f56535754638c5461c0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482586, "uuid": "e90befd4-bde3-454c-b591-5ac40c2bf66b", "comment": "Malware payload (Dridex)", "value": "b121f9a7bd86fe2b85ac1ba3d6796533933e2efec0a2d461be689d94a3704171", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482586, "uuid": "57ad9711-c0e9-4fb3-bf98-1e5f7e97835e", "comment": "Malware payload (Dridex)", "value": "9d101e8f6bb1c887c1af7e1a7e7925a575e4c29b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482586, "uuid": "6dd74133-7ec8-494d-8e89-189ca6637704", "comment": "Malware payload (Dridex)", "value": "b63ee5fabde58374ca1180a5eed0d25aaf4e0911fc04268e01a3f72e49894d440785603234498fbdea6e13213eabd1ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482586, "uuid": "78c7817e-7c80-4937-bca7-e3337f8118c3", "value": "A0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482586, "uuid": "b2ec3e6f-be92-4261-8a85-306368098ff0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482586, "uuid": "990608a1-6537-416d-a925-cac2ec3278d2", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482586, "uuid": "4e127a00-6792-46fd-936f-f799c9ce49a0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482586, "uuid": "40f29229-7f00-4b28-9a13-afd83a3f118f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482586, "uuid": "8d662c54-e398-444b-a43a-be78357138f5", "value": "990cf0d3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6eba21-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620475368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475368, "uuid": "3264e9e0-5143-46ef-bff6-3d6c16704603", "comment": "Malware payload", "value": "ba8427a883cf64c79b482e5a72cce3dc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475368, "uuid": "a6d2d7aa-0727-495d-a8e9-cf2297cfa4b8", "comment": "Malware payload", "value": "b15597aa8fa26476c01411675d93d432de7ada4d8cc8031a9708c20ac6e48c2b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475368, "uuid": "d5ce7c43-35ef-43f4-a263-4a4e9a134b5e", "comment": "Malware payload", "value": "f8693448e9a6a822fe42f87205ee1cd8aa9d75bf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475368, "uuid": "4c189a6c-90b6-4875-a7d7-7c21621867d1", "comment": "Malware payload", "value": "1e291d2aa1697664f02acd79e24ab0cc04c66283de27ff85532eda91e1e7c0a272ab830674b57d2a1782cec94c4a160e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475368, "uuid": "0b65d25b-8d73-4595-9b7f-4107e18553e1", "value": "FEC3B51F6F226FBCF5A5CA7503B74F21D36962C323969A82D17CD1244EA524E180FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475368, "uuid": "a27c2364-fe40-4429-a07f-2b957b7c1433", "value": "3072:COBg93MEtXOi+RpzNxVIN9XExtIeyF0XMaNN19sdgx0CT+J:TBg93jXOi+RpzNxVIN9XExtIeyF0XMac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475368, "uuid": "cfd99525-554e-47c6-8f2b-817893b30e9f", "value": 118268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475368, "uuid": "0fa60115-7fb5-47a0-bcff-78802caef9df", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475368, "uuid": "07bf0717-6648-4a17-b776-ec0fea9c4026", "value": "mips(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0834b9-b006-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482583, "uuid": "21308347-5a17-4c2c-ad6c-210cad9b26af", "comment": "Malware payload (Dridex)", "value": "130ee3b0e3a82a2bc8e9244da4d8f0b3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482583, "uuid": "5d00166f-0613-4d5e-9c24-f5aac5a5f4ba", "comment": "Malware payload (Dridex)", "value": "b1ef624a8b0e220e74551a745ed3a3a318e24fab0dd11209961dc8872b775fe6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482583, "uuid": "ab9e7b17-3dfb-45f5-b4a5-bb7a5b5cc8d7", "comment": "Malware payload (Dridex)", "value": "43b4b90dbcce2527390756852aae34185af6ed64", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482583, "uuid": "5c6c3719-b74a-44eb-a4b2-7f07056d6e9a", "comment": "Malware payload (Dridex)", "value": "e0698b8917f8966ea4360664c70faf0e2e38476b520ec1532b95e1242d3d7b7d99d15b37156607364b695f89e3b80596", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482583, "uuid": "06068b51-def4-47b6-a4b2-c3786354a240", "value": "0BF3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482583, "uuid": "622752c1-e297-4ebf-ae39-225b395dbed8", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482583, "uuid": "6d8876a0-dd3a-4a54-a537-f323a966b7fb", "value": "3072:AuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:A0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482583, "uuid": "ad20953b-b510-4fa3-89cb-f893272e34e8", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482583, "uuid": "19a3fe02-e139-4ee3-9bfd-dff6ffed1d6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482583, "uuid": "2aa18832-0442-4c56-ac3e-86e765e21a52", "value": "130ee3b0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474bb3b3-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457317, "uuid": "386427bd-c95f-48f1-860f-b3be21c55d60", "comment": "Malware payload (Dridex)", "value": "8d2c2b06d923abcedaf65e5f230ae75b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457317, "uuid": "ff178124-eb1b-4e97-a6eb-305d4e24977f", "comment": "Malware payload (Dridex)", "value": "b1f11ebc19e02ede1d5936e0d3e3f3ea65906f20e48cd5d3b9ed716eac85c2ff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457317, "uuid": "4414e9fa-000f-4a58-a8c6-161e96ccab65", "comment": "Malware payload (Dridex)", "value": "157c6465646145a791ae9156822af0512dd6fa33", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457317, "uuid": "f5088857-729a-4bbc-9dbe-c3241a488572", "comment": "Malware payload (Dridex)", "value": "7a695d8c79a729fbf1238600174e8425515ef7e56fab85459ff2584c54c905c04bee958defa9735582c3cee9a29e6f44", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457317, "uuid": "f4259186-a66a-4b1d-a4d5-674edbc4889e", "value": "80F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457317, "uuid": "0e11eaae-17a7-4662-b9ac-5afec69e45b3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457317, "uuid": "fd3a2849-82a1-4449-894d-981184b74608", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457317, "uuid": "6206b5f9-0941-44aa-9681-7e73313148e3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457317, "uuid": "b8959f9e-71b3-412a-8b33-0772f5fdc37d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457317, "uuid": "24aa5016-7ff8-488a-a639-ce252e98af89", "value": "8d2c2b06_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3dca0a-afc8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620456033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456033, "uuid": "a36db1db-aac1-45ad-982e-acdc09b65ebf", "comment": "Malware payload", "value": "85b74eefc6d6b812fe0cde2a64aac544", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456033, "uuid": "bf220bde-3c45-4386-8827-87beb38f6435", "comment": "Malware payload", "value": "b1f23819aa177c44316d283330f07663440019646f9ebfa88b31fae36875f134", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456033, "uuid": "e531004e-68b0-475e-ae16-3320972af68f", "comment": "Malware payload", "value": "9ec5a32b756ece908be9a8b13dd1c2739501c930", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456033, "uuid": "68bbeebb-b41c-4997-b53d-a2a23e9e3f2c", "comment": "Malware payload", "value": "07934cc08d2955287deda2cf18ee69fec7bd5eeead3539f10a9751fb8c2f75eb9df597f86684afdb119acc1974bc3ebc", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456033, "uuid": "0b1b0936-b86f-4d39-99d0-319b234769f3", "value": "1C841285F3E29723F69B0936BE6C7F944199CD6B8BD32C4E211BF01AD4F93221644A74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456033, "uuid": "8dc52575-9ded-4ea1-a9c9-b204f77432ee", "value": "6144:SXS7Z/KPTr+r8hjolXyEmC7LZdBHQKHaL6eGjBZnbEoKYVl2p6Zwj1rPs6BMPY7Q:WS7Z/Uv+rYjUiEr1dOK6L6zjPwoKYiw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456033, "uuid": "067c2f77-9e64-4640-ad55-b6e4c7d4aa32", "value": 376320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456033, "uuid": "34b1ca6f-1dba-4ac3-b447-abbde7ff791c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456033, "uuid": "f0148e79-12e4-4849-983d-1641cf478809", "value": "PO-2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49316f60-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486096, "uuid": "07655aa4-f6ad-4b74-a0e2-40bf29b68fef", "comment": "Malware payload (Dridex)", "value": "55b591aeff7cae69764f7155b38c34e8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486096, "uuid": "50355ae9-08b8-4b3a-9fac-16d401f0c6ce", "comment": "Malware payload (Dridex)", "value": "b24f4b1a9d65e46599660f5adbc4b4b9f2f95fc1b8ec6b223211e4772054ffe5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486096, "uuid": "2c2d5278-88bb-43af-9d05-cdaa4ee5c6fd", "comment": "Malware payload (Dridex)", "value": "cb2f040c3a19c19b9ee3f7040be5731944e5c8ba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486096, "uuid": "f27a74e5-b68c-4718-a4dc-992bd3029e61", "comment": "Malware payload (Dridex)", "value": "231912d4f40e8cd5cb2dd77ecc9e5718dc98ce072e817b62b178b41e038e43c407d946456b84119a612364cf98042d9f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486096, "uuid": "6f595bdc-e89f-40c0-8ef8-f95df818d245", "value": "C6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486096, "uuid": "c1021cda-51ee-4173-8449-939ff5bc4460", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486096, "uuid": "91235f67-af24-4551-a368-5f3039f65809", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486096, "uuid": "11cc2b78-7944-4fc1-8393-f4a0d8b6b025", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486096, "uuid": "fd10aa7d-809b-4ad0-82bd-b92466921c0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486096, "uuid": "68581e13-f52b-40cf-b1f6-26e9ffe3284c", "value": "55b591ae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82bd1257-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489629, "uuid": "dcde8895-ed05-4011-a164-2ffd1b796021", "comment": "Malware payload (Dridex)", "value": "3c81ee843c51ddb9443de7baada9cd0d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489629, "uuid": "c3286afd-64e9-499e-89cf-c2baaba7a0e9", "comment": "Malware payload (Dridex)", "value": "b2f1fd17e7def51c3b3553e081e686ec0d6045f0126d9a90806e451204a26e90", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489629, "uuid": "79b6145b-3e7a-45d7-b4b6-f292de46abd9", "comment": "Malware payload (Dridex)", "value": "cd7ceba1123ec2428e8ccc7dbc943979379598f6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489629, "uuid": "d89ec1df-22c8-4ef0-aa29-ad35be285a01", "comment": "Malware payload (Dridex)", "value": "0da6d75f735399bff0ce122697e14a2ebd8301e9615371cd150b8f9d50a3737220577fb0d47c73da4529d952753c0783", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489629, "uuid": "a345b87a-f05c-4771-a3f5-f66a468cf439", "value": "98F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489629, "uuid": "50292a40-14ac-4a4b-a6eb-e9a6615ae546", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489629, "uuid": "8ca51d48-c972-4b6d-8521-6a15cb40dfc5", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489629, "uuid": "43c5bbf0-9f10-441d-93dd-7e685b17f06d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489629, "uuid": "c830205d-377d-44a0-bf75-ebdf81a249c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489629, "uuid": "e7c63992-0a02-407c-81da-b543898e6a79", "value": "3c81ee84_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a787565a-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471652, "uuid": "69013ff2-2643-4ddb-85fe-29bbe9b5ac5b", "comment": "Malware payload (Dridex)", "value": "04f2fef1cb05cd50eb231cc405de2b7e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471652, "uuid": "a3b162cd-9b8a-46a0-a88e-a6ac26e1845c", "comment": "Malware payload (Dridex)", "value": "b3b3380a53b59c01e2e717c8cb2e3249134bec80e5ecc2f8225cc45418f0bfca", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471652, "uuid": "aa3d6a17-7d1b-4f9d-bd67-091d0742c7db", "comment": "Malware payload (Dridex)", "value": "586f58584030bb3b05f894719d7e3400553968b6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471652, "uuid": "a40d0ee9-d714-49eb-b21f-880536cc442c", "comment": "Malware payload (Dridex)", "value": "fc1fd94b30a3e6a1776dd0172e6101d74988074dbd24fd3f81daeaecc4e8e3b01fa8f340d28ef899de4bf528c709f94c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471652, "uuid": "c9e241f5-65b6-4995-8f2e-e218edf5c05c", "value": "37F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471652, "uuid": "8397b67e-f2c9-494f-a79b-5bbcefe038c9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471652, "uuid": "fe77982c-5f2f-474c-9b5f-c95e648b6e3d", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471652, "uuid": "4a3044a9-27e8-4e22-93f1-2440cc1940a3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471652, "uuid": "649c8160-b644-48b7-85f3-682a0306c988", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471652, "uuid": "1c189adf-bb1c-4b5c-9790-06e804c05069", "value": "04f2fef1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236e5139-afbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620451244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451244, "uuid": "7c022586-6d0e-4df5-8928-727e6b6169f8", "comment": "Malware payload (SnakeKeylogger)", "value": "42f51de42c620d02805aeb329e443080", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451244, "uuid": "f6a0e0bd-00d8-4895-b9d5-bfa42931bf30", "comment": "Malware payload (SnakeKeylogger)", "value": "b3bb032c89238ed4abef9c1f46a9a5469374845275079459617f78b299c21bac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451244, "uuid": "aac04485-0518-4a0a-a7d2-0c2957caecc7", "comment": "Malware payload (SnakeKeylogger)", "value": "2374af4aecf77ebc8ab0cb556b115caab605e51a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451244, "uuid": "5164a27a-a7c9-4d21-8eac-c079340ee086", "comment": "Malware payload (SnakeKeylogger)", "value": "0c61b2e2d50e8dc1c08903737beec70b4208a720beac26d86b33e1e7c25a33d639345f16d2eb5b6b484064b0f51669e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451244, "uuid": "d8770106-4bbc-4865-bdb6-4225066c27b3", "value": "161501652B50DE52DBEC577545A2D32C0BB8BE65AE81C30F6EA8319D3F73B9C4806312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451244, "uuid": "aae20e7a-cc09-4cd4-8097-9c23e49d9f1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451244, "uuid": "b4959e48-b5cc-474e-81a5-e274099d2748", "value": "24576:K4RnrqDMD1kh9LvaYoyIsaclKYBs3TubtdDBwNvLe:V9u3LvVlpPBlbtdFivL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620451244, "uuid": "8b9aba83-423d-4e50-968a-0063e3b4eef5", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620451244, "uuid": "9dc677ad-7912-4406-87f5-c63f0d2a9210", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451244, "uuid": "6a9eab63-a195-4b78-9f9c-dc093a1a701c", "value": "GtAMsYQbQHM7u10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91fb3ceb-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478917, "uuid": "b4d9d2ed-5f58-456c-a95e-5cec0fb06088", "comment": "Malware payload (Dridex)", "value": "6e2b63525cd08220222cbeefc5415c10", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478917, "uuid": "cd147e08-cebd-4945-9bb0-a663cd56eb69", "comment": "Malware payload (Dridex)", "value": "b3e309c448dd0f28e3cee79d011da221acd395e695bfe245afaba62f8f4b9712", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478917, "uuid": "dffe7127-af88-4de4-b010-278fc2787b77", "comment": "Malware payload (Dridex)", "value": "45fb08f9267e3a14a5b62203e20f853aa5dd0273", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478917, "uuid": "ec8aaa93-10b4-4a74-81cb-4e215c4818e1", "comment": "Malware payload (Dridex)", "value": "a94e9173195cd0a7a353f8ba30e2b12a0819f5382925238c9f1828124e99c6cf73ea76c35a1c2cafb8b8583cec3ab436", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478917, "uuid": "369141c3-f520-4563-9b37-1f02b2006fe7", "value": "86F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478917, "uuid": "0f7bab0a-4540-48d5-9812-603b40903ce2", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478917, "uuid": "db101692-07e5-45d3-9ff3-577b65746f0a", "value": "3072:niFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:8eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478917, "uuid": "ef0de6f9-d2af-46f1-832c-ab06401b85a0", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478917, "uuid": "8211c488-9812-4f4a-b383-46355b916142", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478917, "uuid": "267f3c5d-32fb-446c-84d7-95ac4f68381a", "value": "6e2b6352_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d694b2-b027-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620496937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496937, "uuid": "3e36cf92-128a-4ed0-9ff6-7b84b1a5c756", "comment": "Malware payload", "value": "e152235de171287f3432b96a06e56221", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496937, "uuid": "badbcc22-5854-42fb-947b-f6925574336b", "comment": "Malware payload", "value": "b411a08a3bcb06ba60468955397956492a926df2927ea6549105fe5424d6188a", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496937, "uuid": "3c15fda4-11b7-43e8-bfb2-482fdc5c2419", "comment": "Malware payload", "value": "61b039d7dba912f284930d1c8997794226da12d1", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496937, "uuid": "67982c0f-ae7c-4a62-95f3-da8b06b34c65", "comment": "Malware payload", "value": "2561146a5bd1ce595458d2cc45a293b35aafc545fced3606fef1060a26280e727d3c906050914626fefa8744a8b4e993", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496937, "uuid": "7fb0e061-9de7-431f-bdda-4a96f4a63711", "value": "0033E0BFD73C2CC6E8B48A3C4F694E8A1DDDBAF5D4D2B0553B64B0A70B0021A53C5A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496937, "uuid": "e7b60686-3599-4202-a2c0-3e0740bbc3fa", "value": "768:AO0IafWHawQpapwt027Z6pBueymC0fZwmxY6QaOv3uVIgEJC6ZY/7m+2OAodIiuK:AJWcZMFymC0h4rA7mL+Nu1T0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620496937, "uuid": "142fa024-485e-4fad-aea2-2fc041528b63", "value": 51279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620496937, "uuid": "8c61b0ee-8e73-433d-8aa5-532e94f0656b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496937, "uuid": "9cc31948-6621-45a4-ac52-32515f5f11ea", "value": "check 392553.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f81ef6-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435677, "uuid": "1916ac91-6c75-46af-8277-4a5a883b1683", "comment": "Malware payload (Dridex)", "value": "e08246492af725d9c5867df19a530acb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435677, "uuid": "9e54384c-eb09-4bc0-a837-de0ed8831a61", "comment": "Malware payload (Dridex)", "value": "b42602514e0a55905bf1887874c7dfa6627f244cd3dcb88ef31d1114ec8ef85e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435677, "uuid": "7d1ee0c8-5976-4eb8-96c9-839cd9280002", "comment": "Malware payload (Dridex)", "value": "6c48f0e0471aa6fda702bcde6915bfaa861f5d94", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435677, "uuid": "6e60a5c7-debf-4961-9f47-efb0f935d55c", "comment": "Malware payload (Dridex)", "value": "f8658323fff017d39897c8288eab8681a8f27b8e97d290f4ce004bcdaca2b17d387a60fec47969a79d223878e451969d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435677, "uuid": "25b4d0e3-2e6b-48b1-82ac-67735ed32908", "value": "91F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435677, "uuid": "060f25ab-43d9-4643-8882-25a6c0f7d985", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435677, "uuid": "038f180b-0b57-42b3-b64f-b1eefb8f9320", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435677, "uuid": "2deda579-5d05-42c8-8e0f-aa15b8a343e8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435677, "uuid": "9e2fc40e-1a09-48dd-adc2-f814a296783d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435677, "uuid": "e0b022a6-47c3-4cee-ac4f-a22a7aa39ac6", "value": "e0824649_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eab7443-b049-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620511419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511419, "uuid": "0d298e59-317b-4971-aed4-dcf3fd0cd41f", "comment": "Malware payload", "value": "2fb65ee4d6d1df2ddb0dcf91268856be", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511419, "uuid": "b7c3a37c-b9d2-4e77-a3e9-933835819002", "comment": "Malware payload", "value": "b42a5cf6cf6bac2da5203c426dc07f49febd6a1a12c4eb53d29cebc39df3c868", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511419, "uuid": "f027cda2-117e-4159-b483-69498ea89fd3", "comment": "Malware payload", "value": "3cdd9cbecb3b163eaa281c0d589da8c20f538f01", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511419, "uuid": "b565638b-ece2-43b8-8326-c994ba661a31", "comment": "Malware payload", "value": "f371eff3ca28a8bde2eaf6ec9da54be6a64b7e0902db1423540ee19cfd074a5991266861a2cf2d79293d05139bc327df", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511419, "uuid": "142d1f40-fe3b-48f5-aee0-b2a979461810", "value": "D2F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511419, "uuid": "9df53b42-0c6c-4819-b3f8-f7ae89bf5d95", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511419, "uuid": "909581be-1e4f-4357-8509-e89f12b64708", "value": "3072:ge45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:F4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620511419, "uuid": "784c1460-5087-4b1b-9552-0be91c9981c9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620511419, "uuid": "eb31092b-d506-433b-929c-e2288bdcab24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511419, "uuid": "2176b635-49c4-4fa5-8f4d-720c229651b4", "value": "2fb65ee4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9260b2-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442889, "uuid": "6531b361-bb41-4c37-8a3a-e96b1f7510cc", "comment": "Malware payload (Dridex)", "value": "b11ef890122f0ff658887d1aa5296cf5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442889, "uuid": "dd4ff733-5935-40c8-8687-231d71284e82", "comment": "Malware payload (Dridex)", "value": "b6a1fdf78dd3048b02455b50e0d0e466a6faf02f22f6631ed8a13b9a328f23ac", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442889, "uuid": "e5a8bc82-3bc3-45d4-93cd-4da51d5fb040", "comment": "Malware payload (Dridex)", "value": "10fa2c6fb34dc496a4b3eda3e47d988ade84a812", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442889, "uuid": "23cca51f-764b-4f27-a861-395b6d5d5d70", "comment": "Malware payload (Dridex)", "value": "8b89a6da27c2a7697bf24be02e08214184263b1b0177d8ff5269a7f090263316022d69e414582afea4b7c067d624fd0b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442889, "uuid": "55c84dbd-1cd7-4ce1-94bb-991dbc62077e", "value": "C4F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442889, "uuid": "7ce84841-e1bb-48d4-b4b9-768b7126f225", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442889, "uuid": "1cf80a3b-92a1-4435-ba7e-c639ce36a8d3", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442889, "uuid": "0df0e087-8528-4e90-b52a-5bbea35fea95", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442889, "uuid": "f44285c4-ad1f-41ad-bdf0-ee469a3ae6b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442889, "uuid": "796e52a5-47c7-4a0f-81e9-f2a55ed7818d", "value": "b11ef890_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f544c5c-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460874, "uuid": "a8b413f5-4833-4129-ab35-4909a199e538", "comment": "Malware payload (Dridex)", "value": "d1ec1507421e4eed8f7086ff2b2e4cd3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460874, "uuid": "ae0344c5-eccd-46a8-becb-bf2d97326e59", "comment": "Malware payload (Dridex)", "value": "b6a58a518198986fd2301fc14cb79a58b5600d0b40677821917457a2fb2588cb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460874, "uuid": "1d5fd226-fee2-4380-b019-d3a60675fc84", "comment": "Malware payload (Dridex)", "value": "560b81eaba4785415ad35a496dad0b5265ace5ec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460874, "uuid": "766fc54a-73c4-42be-95d3-920810abc552", "comment": "Malware payload (Dridex)", "value": "0df34df4f3f00a8fc9a39941d912bef39106880a2dca26e6609c6592b0ac73a5d1e0c5f741b4e4d8b7aa96c7fd650beb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460874, "uuid": "4713075b-8a5b-4a16-a127-97cdf4d6c4ec", "value": "BAF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460874, "uuid": "322b9ffd-68f3-498e-b269-9c896d94c7f6", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460874, "uuid": "a3fb4cb3-ef2c-4b9a-9c53-b336b3aee2c7", "value": "3072:Ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460874, "uuid": "312b3836-a838-47bd-872b-0d8184476c24", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460874, "uuid": "cb9dcaa6-6e80-407b-864e-3570b6c4974d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460874, "uuid": "e2308f12-9dbd-4389-9743-b7404c1c60c8", "value": "d1ec1507_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998c826b-afbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620451442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451442, "uuid": "5062261d-bfe4-4a07-9b37-74fe8ed8311d", "comment": "Malware payload (Mirai)", "value": "c8cf5ff4573138702093135ae258d295", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451442, "uuid": "09a45768-8622-4562-8851-d23c17f6713e", "comment": "Malware payload (Mirai)", "value": "b6aa8df8edd18b8a62882ce8d69d6c2bdb3cbe44681d17b4b6cfe09620913e66", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451442, "uuid": "a593c265-e5ee-46ce-8ea0-58af6897f3b0", "comment": "Malware payload (Mirai)", "value": "5beea3b92b26debc5321fd16e9b79186b7320322", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451442, "uuid": "94f3c0af-0167-48f9-9f09-dec72f0392d3", "comment": "Malware payload (Mirai)", "value": "18b9431ba9719b6170b310119477f9a4a59e011da5f250873cd9c7d9ae2bbffe0cdfb3f9ef3e427364615c5fc6a3a28d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451442, "uuid": "1f97eeb3-cde6-46c8-918d-72a97c5a1bd1", "value": "82E33C86FA408B13C5C61B76FAAF42493312DB55E3DB73068D185FF43F86A5E4E22606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451442, "uuid": "1bae12a9-5124-4c8d-bf8c-9a0daee45b13", "value": "3072:dYbSBJRwtnTsNL3lYqNA2IYTouy3FpzUHj3azWZSM/9X/r:ibCRunTsfIYTouy3rUzazZM/9X/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620451442, "uuid": "192aa3b6-a39d-4e19-b354-f5accb2c196a", "value": 144095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620451442, "uuid": "cb6ac9c2-4bdd-4d5b-a2dc-2b0b28d42918", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451442, "uuid": "1b34261d-9d4b-4df9-80d1-ea850a1f176c", "value": "KKveTTgaAAsecNNaaaa.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b428e68-afba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620450049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450049, "uuid": "a9ee4265-16a1-459c-9428-b5212b36efa1", "comment": "Malware payload (Dridex)", "value": "e4b03a39d4b71267739d012f016e0f4d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450049, "uuid": "76fbd123-4a63-4d0b-ab37-8e5154b5101a", "comment": "Malware payload (Dridex)", "value": "b6c79d34e7e4e00248a831e98efa825050b272ea1bef9b6ae57408e23163d60c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450049, "uuid": "d7eda899-1485-4a94-8c93-4288b5ec9827", "comment": "Malware payload (Dridex)", "value": "ff1753a1c02a4dba968e896efc256ffe7953ee9d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450049, "uuid": "dfa0f1bd-d162-4f08-9d9a-72249e44bb28", "comment": "Malware payload (Dridex)", "value": "c26937f748be23010ae93ae154f9b5ae2a763e796b6086aba755d28b60dcb9aa41ee6df938f21d175931102d0fa9e79c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450049, "uuid": "f312935b-f4d1-4891-907b-d840c3db27f3", "value": "08F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450049, "uuid": "e4e8a625-04dc-4989-9684-6eca11b13249", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450049, "uuid": "eeafc2a9-0374-47a7-976e-fd2f14d2b4ee", "value": "3072:1A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:13J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620450049, "uuid": "11cf393c-073f-4df9-830b-3a5730942d21", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620450049, "uuid": "02c7b105-4930-4e18-bab4-083b71106eb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450049, "uuid": "53600d45-307d-41ea-bddc-0e6efa5fcee4", "value": "e4b03a39_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41043b69-b028-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620497250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497250, "uuid": "a2a966d7-a14a-4f11-830e-902519a12535", "comment": "Malware payload", "value": "707e442f112fde055bc3c51c93293b3b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497250, "uuid": "caeb2d5b-c0aa-4c79-8a8e-b53dcb878911", "comment": "Malware payload", "value": "b7032147169a289497ab1fd02cc593c354aa6f3c3820d3f1a1b8386817ea0d9c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497250, "uuid": "91b7f654-3ef5-4235-af92-b33bb22ee8a9", "comment": "Malware payload", "value": "553216accc5ac147b724a5c6f88b6f11f1528d37", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497250, "uuid": "e28485e8-55d1-42c0-99dd-5c7dca873358", "comment": "Malware payload", "value": "d069c8c21776b1a54fbff781f72734fe4b183b86b4bd2249478247eafd10ae47354a6639ea744fcfad592ab70a503f5a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497250, "uuid": "b1bcc8f6-be34-402b-85de-dcc86a036c2f", "value": "9BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497250, "uuid": "d2cdec4e-e541-4bcb-8a8a-3caf5ee221b5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497250, "uuid": "9f28695e-74dd-4dde-8821-3ea3f9abff10", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620497250, "uuid": "172f4088-abe3-41ba-bb55-cace8adb5556", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620497250, "uuid": "cc4c1b9e-8b5e-4af4-856c-9cf0476e64e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497250, "uuid": "13604517-a826-48e5-8fa9-71b4b098beae", "value": "707e442f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8390767-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442877, "uuid": "11fa09fe-a4cb-4892-86de-89527c137915", "comment": "Malware payload (Dridex)", "value": "1653c2b936f5796e00be431db46dd9d2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442877, "uuid": "446aabcd-2323-4d70-a05f-b421aebfc253", "comment": "Malware payload (Dridex)", "value": "b72bdc4ee3797b2671c2f5301c74c4b3f97d0775ae51e41a6ff43919a73b520c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442877, "uuid": "661f2816-4773-415c-b419-61ad6d05c7ad", "comment": "Malware payload (Dridex)", "value": "df621362b3eab2186088f25dd9005a3ff0f4f9b0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442877, "uuid": "e8746efa-4d77-4c6d-9f5b-2d4d2a10733c", "comment": "Malware payload (Dridex)", "value": "8cffb16809ce6a2921fc34033d6884317c34d70aba92f94fcfe23aad7062c8ffeba55f199f0eb178bca5239d0ce2e6a6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442877, "uuid": "293adce4-35f6-4249-a322-4152d52b6fa7", "value": "DBF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442877, "uuid": "de8d3daf-add9-4a78-ae7d-15fb63b46196", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442877, "uuid": "9d53377b-b384-4c76-93ab-8e2a8469903b", "value": "3072:PIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Qc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442877, "uuid": "a7ef69d8-f15a-46b5-9b3a-004a51320d88", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442877, "uuid": "b6c91c09-ad5f-402c-9ab2-e9fe03e7def1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442877, "uuid": "99baa236-5f41-42d6-aca8-56b0444c0d87", "value": "1653c2b9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a447cd-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475237, "uuid": "189b1484-964a-427c-a7a3-54768b582d5b", "comment": "Malware payload (Dridex)", "value": "c9f090fea1610c7ceec3635750bee672", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475237, "uuid": "cc85f5c8-c3e6-42e7-bec9-c152207c86ab", "comment": "Malware payload (Dridex)", "value": "b751b6da7214842bf8670dddc0e67f702e4f95c6d8ee1c4315f0af63dbb14ca4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475237, "uuid": "70d4185d-36e2-4b6e-9d09-09e7221110dc", "comment": "Malware payload (Dridex)", "value": "3eae1966bb695c6a47cd7dff20a29ee4c939fa05", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475237, "uuid": "ece9ca92-9938-44ce-b174-1dedd7afb16f", "comment": "Malware payload (Dridex)", "value": "a511ee67ee6e6a6c57070c908a155c639eadef59630975dbdd9743b3bc96e969fca47a06fbb6a6a02482349a951b8ae5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475237, "uuid": "f6ce82f9-9cb0-4908-84cf-138b23085875", "value": "B9F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475237, "uuid": "945cbb9f-39c4-4361-9aa5-bee39d7d9a90", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475237, "uuid": "70f929c0-e5f3-45f6-bfeb-0ce9acb7e484", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475237, "uuid": "adf8f5b6-dc1b-4848-bda1-d97cfd6e82ac", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475237, "uuid": "8e32d319-9db9-49e8-bf5f-aaab6dd124e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475237, "uuid": "d5d42cd5-b525-4c5e-89d9-60cce1777673", "value": "c9f090fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e798738f-afd2-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620460592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460592, "uuid": "cd388809-ae46-4772-ba99-5155b49598f7", "comment": "Malware payload (NanoCore)", "value": "5d7407f7f1ddd00f4b36b73121166487", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460592, "uuid": "1988a1d6-ba34-40a3-af5b-341b4e658207", "comment": "Malware payload (NanoCore)", "value": "b77b542ab77c2601f19845cc2927351a34225264290a6d63689535ea7a920e2f", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460592, "uuid": "cdcdb49d-675f-4b8c-9084-6a90f56dca61", "comment": "Malware payload (NanoCore)", "value": "8341f2ba57483d240c588ed9dd5a26975ee68bb2", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460592, "uuid": "1ce3ea15-0376-490e-a8a6-82fcdb8f148e", "comment": "Malware payload (NanoCore)", "value": "5075dce4384850e30efe0900ccd8ce1e31a8e574652d3e5b155250a9a1964bc412aab47161d45077a3d5e2f80af100fb", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460592, "uuid": "f7982a5e-6d0f-4288-842c-5485e8e56df5", "value": "49F4129C6BECAF10D6AE6F7605F1904502B6BC0B6823F33E15B874765A733B086217B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460592, "uuid": "ca64a11a-b323-42cf-a09a-59ee07f71951", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460592, "uuid": "93970459-f9d9-4788-93a9-7ba81bf2a05b", "value": "12288:0PjnJMrSR/ERApZHHsw4ZOcogiuwSk7XdLU/9JcMiZpQ2Gc+MjTvWZtfUdE8gStD:UVoSfPHMw2oFr7pEbcvZzt7QtfUdE89i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460592, "uuid": "364c529c-2db4-47ef-ba7f-83fd327c7983", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460592, "uuid": "82f888b3-b117-4981-a7bb-3534c364b69c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460592, "uuid": "0f1e8153-a2ba-483e-97a4-d9a1817a7ab0", "value": "NEW ORDER pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53863346-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475376, "uuid": "c6772451-c87d-4fb7-a8f7-d5f29caad892", "comment": "Malware payload (Mirai)", "value": "53289413404b93ded631f1220dac6b1a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475376, "uuid": "1bcd3462-7174-4ccc-94be-ec154ee20e48", "comment": "Malware payload (Mirai)", "value": "b7b828c07e428412704ecb27c78b0b147c1d87b8217c0b0bcee6dcc2eb25bba3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475376, "uuid": "ba29276f-e289-4d4b-b503-ec67934f5b00", "comment": "Malware payload (Mirai)", "value": "e81bc49d1ed2bf8acee33814fe9b3c704f74ede2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475376, "uuid": "b9a0400c-e355-4f4f-993e-2aecdd850a80", "comment": "Malware payload (Mirai)", "value": "308c25f9354eb3650a33816ad6d68c8701cab863e2d2a3e7131af169422c30eb307b6b6d24b7b18afbc5aa8100c34677", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475376, "uuid": "f6bffd93-0ed5-4f29-91b8-756a5c268551", "value": "54533B0077948F0BF4AA5EF5283F17E483BEEE4016E5F1846A0FE64A8235E335559F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475376, "uuid": "1f892441-74bc-4851-85a3-093e8545938b", "value": "768:LBFWn7icJpjqWBRunbEJn23dZk+0YXfdi+Qq5sU05vlYGoWKchU5d9e8BV6grkn4:AeYysnMBfAn3dkGoWKxesknenV3XLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475376, "uuid": "be4ad048-f2b9-448c-b779-bf27a58e729f", "value": 66656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475376, "uuid": "54716b86-26a4-4cd6-bb76-042952793929", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475376, "uuid": "e3939dd9-0bb8-4d2e-9829-f3cda58389a2", "value": "KKveTTgaAAsecNNaaaa.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467fb52f-b028-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620497259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497259, "uuid": "d1eadbc5-8706-4c91-aee2-275f477d79f0", "comment": "Malware payload (Dridex)", "value": "18c38a99e8a8e1d9668dc610b5948d33", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497259, "uuid": "199f5ad5-9987-4402-a9e1-52f345f3c62b", "comment": "Malware payload (Dridex)", "value": "b7e7ebcc3f26485de815992bba00479600ef36dcee746627da924ec4d0aead05", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497259, "uuid": "fdad6dc0-f468-44c8-904f-26f09feb003a", "comment": "Malware payload (Dridex)", "value": "c32b47014fbe2530354c4fb103cfbc6fd1dfe51b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497259, "uuid": "51a238de-a69a-47f7-9378-048e0c05f3b2", "comment": "Malware payload (Dridex)", "value": "1b2b49ebf1d7cef6914babf736fb1174bd72586221049cb7cf422273db252903f485f1a0f05ddcb343a5c92039295620", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497259, "uuid": "04fd6b94-bfff-45a3-b24a-acf50076b186", "value": "19F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497259, "uuid": "6b358635-3f66-43b0-97db-01793a4a04ed", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497259, "uuid": "9e14e74b-d6b8-4cc4-8c30-9aa0b23b2df6", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620497259, "uuid": "8039ab2b-73d6-4169-a2f6-e0f138057096", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620497259, "uuid": "0d1980ba-1ade-45f6-b5fb-a16fa4c652ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497259, "uuid": "05b09476-bc8c-4bc0-ba80-c66390a21f14", "value": "18c38a99_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6e286a-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457297, "uuid": "44ed2eea-bfdd-4305-9c14-ae5e66f84d38", "comment": "Malware payload (Dridex)", "value": "ed36ca409ea9dbb88a9e3a1038fa92fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457297, "uuid": "74b58b26-1d20-44d2-bb60-bca6dd5da7a9", "comment": "Malware payload (Dridex)", "value": "b85a0db863dbca8bf4eb013155d012e169b07b68f332772b3c52df77a6d71a62", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457297, "uuid": "e1d8f6a4-f834-4c51-ad35-5063f7014b6e", "comment": "Malware payload (Dridex)", "value": "45459771f1a7ecd9aa6003825a3f5ab6bcd12485", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457297, "uuid": "233a0494-b243-46fa-af40-9325f7201b34", "comment": "Malware payload (Dridex)", "value": "70eff4c18db7421313644b022297528b4e417a3fec5aa068d87f1e2da1efc6ca7a706efe9f03e37280a68afc5970b908", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457297, "uuid": "4a464c53-af38-48e5-a785-e8013e0f7057", "value": "09F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457297, "uuid": "b97136c0-8af5-4d84-9077-478dafb8dfbf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457297, "uuid": "3928449f-2791-4303-8f7f-b8b7bb7b8399", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457297, "uuid": "3f6da38a-9355-4006-93a5-0e7600a71334", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457297, "uuid": "2317075a-9f45-4ff1-a3f5-61b7341ce920", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457297, "uuid": "074a6e88-436e-4e75-9319-43d445fd56d6", "value": "ed36ca40_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43dd57fd-afca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620456882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456882, "uuid": "1fa40033-9ce7-40ce-94c6-764026db80a3", "comment": "Malware payload (Stop)", "value": "88ebc058c0e9e104f425f0a48c7d84ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456882, "uuid": "3f692838-eb35-4283-8fb2-9a53895adbae", "comment": "Malware payload (Stop)", "value": "b9aaf852417503d7ff055b60e91d326743e7f0e225d51ba63b726e137aa64810", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456882, "uuid": "30ccac15-f8cc-47f1-9a8f-9e982242674e", "comment": "Malware payload (Stop)", "value": "e9e8354710512b4b09066fe7a4cedebb43f20d61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456882, "uuid": "e9a08718-609c-4931-9acf-264ad89d4793", "comment": "Malware payload (Stop)", "value": "46c14065a6ba548fa1df6d836f93453182c4cfa8a8df54111a4d37b3d23eccdff455b92be297481c1a1b012a43044ae5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456882, "uuid": "3517ea7f-e385-407c-bd1b-9ad9a3341037", "value": "1315F123A790C437E5B701F449AA93B8A52D79B85B3461CB53D42BEE57346E0BC30E4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456882, "uuid": "60ec442f-0ac0-4df3-97a3-a4ab96e84fc5", "value": "5f1a8fb17e535ee15ba0bcd80f9090af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456882, "uuid": "d05990fd-41f4-413b-a91c-7a2fbc55a63f", "value": "24576:bk33/Y6vcPrry+9jHxZLrJM5XnLwTi6172f:6Y3jvhXpi7wl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456882, "uuid": "2bc42bb6-da4d-4a92-9026-ae3c8ce7d217", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456882, "uuid": "6234b73d-f2f7-4189-a518-ea9263f512fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456882, "uuid": "89085caf-3ced-4d0f-8a43-eb5b5461e3ee", "value": "88ebc058c0e9e104f425f0a48c7d84ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f9a7df-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435630, "uuid": "ed7ac4b5-1d7d-48d2-bfd6-e3159119f250", "comment": "Malware payload (Dridex)", "value": "8583567183ab346595737db81d44be66", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435630, "uuid": "8c6c4241-a411-421a-8381-982855b41503", "comment": "Malware payload (Dridex)", "value": "b9b8f3f89933ffa376b3349232fda67789173c3e710291f2f020751b82e32e89", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435630, "uuid": "c2d38354-1548-4d2e-b6b3-26c2390ef285", "comment": "Malware payload (Dridex)", "value": "cd8b96a0887e78023cac89e8c52595d05acfea4e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435630, "uuid": "3d2300f1-b454-4f64-baa7-46678a313572", "comment": "Malware payload (Dridex)", "value": "a39945ea76ca6e366732cbfbbf85b4e2f02c270908eaad8d4df0a3f27fa7c5a1dd81099173195d9ec31dd82dfb9982e7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435630, "uuid": "88d648bf-0bf7-43dd-9f5b-542d2c81d5e4", "value": "08F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435630, "uuid": "995139c4-83e2-4f61-b4f1-034c0fbe895a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435630, "uuid": "5c8a652f-caad-4807-a276-205f6bc0543a", "value": "3072:AIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Zc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435630, "uuid": "8d11cf44-2a35-462c-9102-0a01850d26a6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435630, "uuid": "b6089c30-2276-40b5-b7f6-74f04fee6b70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435630, "uuid": "fcf3d3f6-fb6a-44a2-8c6b-63ea65831494", "value": "85835671_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55bd189c-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "23481735-6c4c-4bb0-9b8c-25e754618f00", "comment": "Malware payload (Mirai)", "value": "e7fb80a6c0145f03ff163d39a11f6a4b", "object_relation": "md5", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "92278540-4cd5-4290-97bb-55f0524f5aba", "comment": "Malware payload (Mirai)", "value": "baafcb13d7d2c6a5d2fb2022c697ce8208764b6d571d6741b10e1cd22737de96", "object_relation": "sha256", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "93fc1e2a-64bc-4687-8e86-64f9445eadcc", "comment": "Malware payload (Mirai)", "value": "4c0122b1f539b2e1dee0c01710b8cc3de6247616", "object_relation": "sha1", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "356af4d1-bbc8-4a96-846a-8e9a526650e5", "comment": "Malware payload (Mirai)", "value": "02f8d05157bebd31abac49598d9369c2f3f0d714720e2af3b34dea82f9af697e46babbf5c70c1c77395ea5eadc249ddd", "object_relation": "sha3-384", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "b9681c11-447c-4725-af20-aad1dc54caa0", "value": "AC542A46E6D8A72BC3D223BAFA7A0B6F33358649A7D672155D3016743FC27187B36024", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "394c3859-5f16-4242-8050-3cfa18a7002b", "value": "6144:qwT44QfnafR7lxaqamPUvGNl92LkhmJ9s3uj:qwDknaxjgV02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475380, "uuid": "3436312f-a34c-45f8-8b85-e75d00875b8b", "value": 281941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475380, "uuid": "1a6b7b7c-b35e-4a77-becc-98045d55926e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "dc1e3dd5-88ab-43ff-accb-1be0bbf7c9d2", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b23b6f-afab-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620443783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620443783, "uuid": "3094b2a7-7afb-4038-a68e-bac9e3dcb262", "comment": "Malware payload (Formbook)", "value": "4d2dfa95fd5af26aa2c2f44b4f54a73a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620443783, "uuid": "91e8036d-e601-4b6c-8d2a-1d0b0ce965e2", "comment": "Malware payload (Formbook)", "value": "babda8d430f5f46986eacf505ee1cb9cf017032bf4ec985fa20a1a6c73e7543e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620443783, "uuid": "e358d303-0a62-469b-98c1-2e49cc73d467", "comment": "Malware payload (Formbook)", "value": "2dd957be65d8a28140b7a910e8b9da9b695ef281", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620443783, "uuid": "a2f9fb65-cd02-4d77-a9a6-2260259a0ca7", "comment": "Malware payload (Formbook)", "value": "8eab54b6c5634c7f91e07bb6df3b0dc5d053b840d5a0cf7fe3942a3cdb66c14bb5993a5b24d449e0b667bf4780b0642a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620443783, "uuid": "16f64625-bdf2-4b7c-aa32-0c31201604e6", "value": "DF241276B5D8E2B3D16746F10CB293A6D3FAEA050211AB4733680F670A751CE8F1D196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620443783, "uuid": "d02d215c-5fa9-4a30-9371-2852761e8771", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620443783, "uuid": "8e46ff60-be14-4f8c-8670-315c731132d7", "value": "3072:xPA6jXFN2MclWY6WX8n8uF/yaZ2KHy02m3CYDYsVBmqN++Ho224esRh6zOyZTksW:xhjm9pX3uTs0reedos+1kFBY2Y/VdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620443783, "uuid": "75c33ff7-d4e2-4164-a92b-c6a4acfc67f4", "value": 217275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620443783, "uuid": "8ae2c405-25d0-426d-8c3e-c26435c5feee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620443783, "uuid": "2fd6362f-16ee-46fe-bcda-7a330002ca29", "value": "babda8d430f5f46986eacf505ee1cb9cf017032bf4ec985fa20a1a6c73e7543e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b523ed8-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489643, "uuid": "686786a0-39eb-4c53-a719-1067cf1a3875", "comment": "Malware payload (Dridex)", "value": "99629c8322d26b94ab6e72d189836935", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489643, "uuid": "68ce00a2-f8a8-4d20-a618-f06c3d6bbd29", "comment": "Malware payload (Dridex)", "value": "baf4238a8d8461b7b9d5dee4d212d8d54e9822ffa4d2718c67110f566147369a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489643, "uuid": "321304d0-f32f-40d9-8e22-db44348443a2", "comment": "Malware payload (Dridex)", "value": "4111aa2a34334b8dfc2240d82959a5f37f0a3539", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489643, "uuid": "05ea3e5f-bbfd-46eb-8c82-4f2dc8b504f0", "comment": "Malware payload (Dridex)", "value": "b4d88f0d02076f672b63afba3b44fd19616b6cc8f23d22132c5743d85d199a29ca5413516d7c1a80950fc7f4b2635f5d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489643, "uuid": "1b083f38-3df9-406b-8e2a-4d4a3f0a9e14", "value": "CCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489643, "uuid": "5ee6a961-05aa-464c-8baa-d5c28782bde1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489643, "uuid": "259b417d-a60b-4358-8d40-eeddb2007bcb", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489643, "uuid": "55d96955-0294-4ea7-90a0-83dd55022df5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489643, "uuid": "674af0d9-a191-4cdb-9e6f-1e5df29aacda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489643, "uuid": "6a335a2c-14d8-4df0-9685-a65f481b8a6d", "value": "99629c83_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f9b1d8-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475436, "uuid": "30cbaf76-ff2d-41a1-aeeb-ce918fd9039f", "comment": "Malware payload (Mirai)", "value": "96325fdb2a0f621d69139f988e062b27", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475436, "uuid": "04214ba5-19e8-426a-ac2d-3a1cbf142dcc", "comment": "Malware payload (Mirai)", "value": "bb1de43c7839f1dd0a64498d586f2b070a301fe9d496ff3ccc35c67409c8855b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475436, "uuid": "1903d541-d467-4b84-b788-b0e783bb33d4", "comment": "Malware payload (Mirai)", "value": "5fb916c4791b892bda0ddbc2e18d60bc9ba72628", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475436, "uuid": "63979ed6-a7bb-40e9-b788-cc5563baf0b5", "comment": "Malware payload (Mirai)", "value": "7e5386a9cb2248dec382354cf8182b90c5449ab3149c8555953bfbc24b702c4803555e4aa060257b977168814b9900a4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475436, "uuid": "27ea8297-cb58-4907-9ca6-59bb84e2b676", "value": "B9E2F1B369F9E358E9296132637B382EB552E84D722541F24EC0007D58C6F7A2FB0F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475436, "uuid": "83b6c6ac-0463-415c-a816-e17f4b1820e2", "value": "768:oMHXuTfHz40EbuIn6T75jDAa2cIf6VE8VnbcuyD7UHQRjL5:oIe7ebuI6ZcbfCVJVnouy8Hy35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475436, "uuid": "59326d42-e54a-4879-b513-72df960dc53d", "value": 33328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475436, "uuid": "6bb6fb98-156e-49cc-875d-96296057c480", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475436, "uuid": "3756b331-2845-415e-ae63-eb512ad43c56", "value": "xd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd42486-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478962, "uuid": "b1bd4819-bfd6-44b4-9a45-6a30686cfce5", "comment": "Malware payload (Dridex)", "value": "cfd3b43aec7884679d42660746249deb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478962, "uuid": "ed3657fd-6d1c-4571-9adc-2cf2ffce1c56", "comment": "Malware payload (Dridex)", "value": "bbba05f61b07c625eef97976c0b08ef9b9fc8b99d10a3dfbfb69b2080bf50849", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478962, "uuid": "fef06827-a954-4d89-8fb8-424d69c87dc4", "comment": "Malware payload (Dridex)", "value": "79de23b4409daef9c18df0f27772447b33d9869d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478962, "uuid": "faaed8e4-d91c-4943-addc-2343cec0ca78", "comment": "Malware payload (Dridex)", "value": "a4259a4f11b43d49c4e5f4e15f853a84e70c24c54ef5bcfdbbe9e347b452ff22e5a88b8e861f3cba3c806885a6e3b4a0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478962, "uuid": "be19b3cf-6314-414a-b5b9-55fee0b29ad4", "value": "B0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478962, "uuid": "3fe83206-5325-4660-9bd3-04c4eef5581b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478962, "uuid": "5a67b366-b1b1-4926-a9ff-e72fd5749f78", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478962, "uuid": "4cbaf434-894a-444f-bd41-ac8bae534eb8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478962, "uuid": "fa37ab26-4ed6-4ebb-b8a2-bb7870836d7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478962, "uuid": "f01aeb91-c7b2-456f-8661-14947eb9fa0e", "value": "cfd3b43a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf001db2-b040-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620507796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507796, "uuid": "5f06ea25-e97f-415f-9e28-d970afb54de9", "comment": "Malware payload", "value": "bd7ecf5ed2f963ef62b66e1025209009", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507796, "uuid": "36d99d5b-d343-4dd8-b84e-41a288e348ca", "comment": "Malware payload", "value": "bc7877800abd637f5f11651e0c15323f7b61c2c11f412c4e13eab20eeb238079", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507796, "uuid": "84bff557-a92e-468e-83cd-9f8a16ec5813", "comment": "Malware payload", "value": "3209de22f7cd2899f22415331d13276f7eb3102e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507796, "uuid": "bc76418d-c837-4629-bccb-42312461108e", "comment": "Malware payload", "value": "84e157c4fbadb44e6bde37cef4b5756efade494104ed81d6b3fda33fda4780fc264346e6e66ec00215541f9f62206f98", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507796, "uuid": "fd8f03ff-f936-4d7f-a43e-38d8750f248b", "value": "FCF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507796, "uuid": "75026a53-b325-45dd-811e-d4e640af3710", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507796, "uuid": "d3d6f97a-08ba-48fe-ab48-e70f653fcf71", "value": "3072:/lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:/lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620507796, "uuid": "dbe2ccad-0878-4f2d-9e8b-77f73b157e35", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620507796, "uuid": "1342c900-b236-4772-b833-67780dca0bb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507796, "uuid": "9dd34a65-bb99-4d3f-813c-6efebd268eed", "value": "bd7ecf5e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4bb9cc-b020-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493838, "uuid": "ab0deab8-8064-4f31-a55e-54be3df6e227", "comment": "Malware payload (Dridex)", "value": "8ae87814c9468b0d343353c6bb8f33e6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493838, "uuid": "8cffd79e-54ee-4718-bd6b-d6cb67e259aa", "comment": "Malware payload (Dridex)", "value": "bccab78011197dc8dce06d3c7629ff1158c101d37965f43851261603a371a21f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493838, "uuid": "0ed1f6ae-1738-40a9-92ed-ef0d6ff9d95e", "comment": "Malware payload (Dridex)", "value": "e6842ba4d1282cad8d29e23e6a7b01fc1158953b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493838, "uuid": "28f8a185-7f24-4eb0-a816-25e7836d1be1", "comment": "Malware payload (Dridex)", "value": "2321236f5b61ce9ec254c20af53a79bc26df67c1576e7c6aa6fd66362dc4886fc9ffa9ea54e485e08de16eff508c5304", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493838, "uuid": "06985804-d96a-4c55-ad35-60d3feb1d801", "value": "44F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493838, "uuid": "89a51a4d-61b5-417a-9a6d-e6820e1a85c9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493838, "uuid": "6bf859a4-3a78-454b-afc7-3e0135e1f531", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493838, "uuid": "854df4fc-af9d-4da6-b443-e792eda97d15", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493838, "uuid": "ea406fcf-454c-43dd-9b4a-b0a83824c951", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493838, "uuid": "c811d2fa-fc63-44da-ad1d-455a3514c567", "value": "8ae87814_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661453aa-afba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620450067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450067, "uuid": "712db60d-eedf-4f52-a2a5-7667fdd5a75f", "comment": "Malware payload (Dridex)", "value": "872b3ea62d0d9bb8002e2d1400bca15d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450067, "uuid": "0bfd5d6d-70ea-4398-b4fc-c24488b46d22", "comment": "Malware payload (Dridex)", "value": "bde9dbab06bdf7254257e94e1f6a48d2be9db444a53af7c51ff03654ee7e1f2a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450067, "uuid": "3ba900e3-2fb8-4522-b835-a0e322e52f2f", "comment": "Malware payload (Dridex)", "value": "02608e057bed70b644603b4112e8c7170fd8dfd5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450067, "uuid": "a51d0855-0700-4980-95a2-4675c43d2acf", "comment": "Malware payload (Dridex)", "value": "8f34d92e6e6120bc32255d4dfd1f121f915999b53036e708ef7233ea05d01bef657e3060212cacc886e340d80e50023e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450067, "uuid": "b21c30c4-1867-4fa1-bb3c-6fae18e213a0", "value": "51F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450067, "uuid": "428d8954-132a-4e10-8ae7-aefad1221886", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450067, "uuid": "f5cc3388-2071-4de1-9f89-39db1f84ac62", "value": "3072:he45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:A4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620450067, "uuid": "ffd2993a-6848-412a-a406-a5bebda90474", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620450067, "uuid": "f01ddf65-6fa5-4adc-b053-4f475365931c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450067, "uuid": "4b45e864-e801-494f-aaf7-38d267f3187f", "value": "872b3ea6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125e763c-b049-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620511345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511345, "uuid": "50444aab-52b1-4851-b87b-b0725b49098d", "comment": "Malware payload", "value": "ae80eba283e81dad4d7d23639d55bd2e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511345, "uuid": "0156b6c4-b3b7-4170-bed7-ac6c5f2b2835", "comment": "Malware payload", "value": "bfa1e913cdca34ead1f45b0990a248bed8ae6fc1f9284962f6e17d5ee5190c3b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511345, "uuid": "898de485-be36-4be6-8174-d5855623a4e9", "comment": "Malware payload", "value": "1be1bca43f670b3e06bacec28ac4dc38e1074ef1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511345, "uuid": "568067a8-3edc-4c29-98b2-c5dc2a871b96", "comment": "Malware payload", "value": "6034998337af437b641ab3aa3cd3fbfdbd21667e23a82b173d9835eecc09078828c6190106ed1eb4ba4f4071a439b3c4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511345, "uuid": "fe35373f-e084-4da2-846c-79bd8482744f", "value": "C6F3C141C9C5CCF0CBE36C3A4695963B3228B541995A8E42EC64CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511345, "uuid": "1218a12f-a506-4297-a573-d7a7368c3fff", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511345, "uuid": "25816e1d-67f0-4247-9927-42778bd827e0", "value": "3072:HuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+HY:H0czbty9uiaJlOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620511345, "uuid": "55337d25-acef-455c-8abd-50bf0489afe4", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620511345, "uuid": "5e73657b-9ec3-446b-aa97-6d6c3dc4442b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511345, "uuid": "bd4591f3-e6e4-4a95-84d5-e6413cf9e922", "value": "ae80eba2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684a3146-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468110, "uuid": "29995ef4-0811-4afa-8c4f-598d2afd6c8d", "comment": "Malware payload (Dridex)", "value": "0a495d0c51bbb0c03e5b1d205133ada8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468110, "uuid": "b769aca8-11bb-4297-8f15-cd33f1a748ba", "comment": "Malware payload (Dridex)", "value": "bfa860afcc54eaa1d056f5285395b27111f5afdcf85eaac60cd5cbbae85bb7b6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468110, "uuid": "38342e09-2c70-4c24-a138-d47c9c8e5e4a", "comment": "Malware payload (Dridex)", "value": "06b00f9ef25eec6baa123539324200914f0e3ccb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468110, "uuid": "9828e3d0-dabf-4f3f-81a6-9f8312240cc6", "comment": "Malware payload (Dridex)", "value": "4ac7295c6443a80f4b345b4771fd06517604b56eca1b928f09cf99981dd2ea0fc268c09b2045b6667cd4a4bb2835e3a1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468110, "uuid": "2e8b41a1-ed6c-46be-82f2-3cdbf450fc32", "value": "9DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468110, "uuid": "0a61ca87-e430-40da-98c9-763837478864", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468110, "uuid": "c5dfec47-384b-4b66-8223-4c3bb1f185f3", "value": "3072:mlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:mlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468110, "uuid": "1c876a9d-d6d4-4501-8aaa-471d21fc7856", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468110, "uuid": "386951f7-e3b3-46c9-b3b8-6af408b10d8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468110, "uuid": "606eb8ce-2ca1-4a16-80a9-1086ba7a1d30", "value": "0a495d0c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bcb1d2e-b020-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493832, "uuid": "bdfdaab9-9ebe-433c-aa07-a4dd54a1757f", "comment": "Malware payload (Dridex)", "value": "4a4fa422b5613e92fdc688253242c6c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493832, "uuid": "89d011c7-3aac-41d7-aa50-74e4ad5e6970", "comment": "Malware payload (Dridex)", "value": "c0360f6145ebd7a23a07f2e4f9d55a5fdb98332c605ff14ab93579a93ebef6d2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493832, "uuid": "a945a6c5-aef9-4f28-b887-3afcc0ddd7b6", "comment": "Malware payload (Dridex)", "value": "7dfa4fd24113a7679237dea0fa8640970315123b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493832, "uuid": "15b7ef11-5157-43da-b6e5-f28e07c6d1f7", "comment": "Malware payload (Dridex)", "value": "e830b3c2aa50914f5c6c90d46ad9e12b22e3df97126126fc75d8e4e63fc83d40ae779685839b87f393e89afa03d637fb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493832, "uuid": "9c3c0f0c-0bfa-4a53-984b-9a62c28f0c25", "value": "4EF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493832, "uuid": "470f6acb-3d09-4cbc-a807-9b3f0dda53ba", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493832, "uuid": "6767226c-5e29-4bce-a69b-f82626285f59", "value": "3072:BWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:B42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493832, "uuid": "780dfe80-e9c4-4698-b9d3-0738544277a2", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493832, "uuid": "28994daf-4e51-4eee-a45c-cdffd5b4ed8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493832, "uuid": "38b8be36-3667-47ac-b250-41cdc4a4389a", "value": "4a4fa422_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e208164-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489648, "uuid": "c654c1f4-2982-4057-bea2-ca434c19c849", "comment": "Malware payload (Dridex)", "value": "3b58ac7464a0bb07207424ccb31d2876", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489648, "uuid": "de17eda9-52f5-44b3-81da-2e460721e6e4", "comment": "Malware payload (Dridex)", "value": "c134e5a8dffe0d1da1756ffced192705fb40333a4443f158e79afe21203ede13", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489648, "uuid": "dae7517d-644c-4fb3-8712-611ddb312056", "comment": "Malware payload (Dridex)", "value": "fd9e122eb346e25c72117f3ed4136a035dbd92de", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489648, "uuid": "ee6b214b-60be-4c28-8eae-66ed6e49dd69", "comment": "Malware payload (Dridex)", "value": "5ee6accfbe0bcfefb332a861ef945390b6fbded42b3795db07a99589acd477ea86cdb9be1c45f912f17fc8933bb0ef90", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489648, "uuid": "f12346b9-9a80-49a6-baf3-31b7e94cf29a", "value": "1BF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489648, "uuid": "7cbd2d18-edde-42ed-865e-480e1897ad61", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489648, "uuid": "56874702-6e46-46ca-91f5-392a8b0280fa", "value": "3072:9e45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:E4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489648, "uuid": "51c9dff0-cd6e-4f0b-af33-9b09bfc0f35d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489648, "uuid": "189cb006-a70e-42f6-b077-88f0aaa52b55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489648, "uuid": "96ea825e-adc7-4e8e-a199-ac36da4923b5", "value": "3b58ac74_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e19d2c-afb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446475, "uuid": "b2c8c7c5-02ca-485e-b83f-c9f58434d99d", "comment": "Malware payload (Dridex)", "value": "afd35a3e956c4fab3d15b7a027d10714", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446475, "uuid": "94baee6a-51f9-4c0a-a87a-0b002ef471e1", "comment": "Malware payload (Dridex)", "value": "c2590c1bd469a4f871fbbdda29521e86a3ae7510e828d10e747704d04ac34244", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446475, "uuid": "278f1542-7b4f-4316-871c-9448ab78a86a", "comment": "Malware payload (Dridex)", "value": "72fe1f61d353ce467c40b86e495a18bbef181dc6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446475, "uuid": "8e36ea9a-262a-45fc-ab5e-90d663d4d2e7", "comment": "Malware payload (Dridex)", "value": "debe5447d74f8c4355e48c8fefe3b6fbb39fab40838c82a8d89f3ac0e14a9cca35bfcd83d5b4157dc2657423b17538d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446475, "uuid": "3d0858cf-0209-42c2-99cb-7f4768900048", "value": "85F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446475, "uuid": "404d0634-9fcf-445b-bb4a-e1552aa573cb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446475, "uuid": "eac0768d-3e7d-4264-b3ae-36c6a9f60d88", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446475, "uuid": "7f915bf0-6eff-4836-85aa-cac26892994e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446475, "uuid": "ffefb9f6-68be-432a-a34d-764b8ff48cc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446475, "uuid": "9edba61b-b725-49c7-92db-3ef6b12394b5", "value": "afd35a3e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc27a44-afb1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446428, "uuid": "dfa52529-6095-4545-828a-ace70dc22fb0", "comment": "Malware payload (Dridex)", "value": "ed884b62cf1da0589b57a1b65ab2568b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446428, "uuid": "6e26191a-7b47-4251-855f-f51df6b95131", "comment": "Malware payload (Dridex)", "value": "c26ee58cf40b0c5a63419966fe9004539597f2d58a69ae92b08f552a8cc2d3bd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446428, "uuid": "fb4c5a42-7d50-49c1-ac1f-32d67e49de8d", "comment": "Malware payload (Dridex)", "value": "0f94cb149874f4d4d9b45b3472d0a7df9ae6dc34", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446428, "uuid": "6eb08fbc-b666-43df-a00a-9196b04c368c", "comment": "Malware payload (Dridex)", "value": "46c0299163a06a62a5e605b244276a1af1d9c01354015aee98631e0d54b3e1ce80b8282e5079bc129a49ba4a8d5ed7f4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446428, "uuid": "5d8d52d6-68b4-4692-9752-f121087ea35a", "value": "49F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446428, "uuid": "3ad1d04c-2d43-4737-ab37-123046d83ad3", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446428, "uuid": "a8e1842b-d29e-4923-8379-78db857d391d", "value": "3072:uWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:u42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446428, "uuid": "6708feb2-01dc-4571-860f-bad074c484be", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446428, "uuid": "0ea315c0-8be1-4127-b37f-4ca790602ab4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446428, "uuid": "fd285527-bc2d-4717-8e04-31c1eed3168f", "value": "ed884b62_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6bbcbe-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620486051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486051, "uuid": "062f2110-e94c-4115-95e7-bb0212589f14", "comment": "Malware payload", "value": "da27cc5a113a1f87b1bd697596e8958e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486051, "uuid": "a573e77f-4040-47ac-9537-ac01724b390d", "comment": "Malware payload", "value": "c29be57a64bbc0e53c8ab71b55fbbc5b1680bcd2fad2c7a6f642a7c6c09c9a68", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486051, "uuid": "6f3fd254-6497-4bb8-94a7-7221f4bc8ef3", "comment": "Malware payload", "value": "72a6d5a91c4ab2837dc23797758a9777fe7c47b6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486051, "uuid": "073b5946-633b-401d-b3b1-94a98ce0f438", "comment": "Malware payload", "value": "16ad4597e5d8005fa37e8a08f9e4bf26a1d42e73696fdea5a0054f2c12108bd49973baeafce9bf2e8745fff462b8aa4b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486051, "uuid": "097267d2-e735-408e-97cc-3d6e5c77391b", "value": "490633279C343D96703AABF14B85757D0D99D0EAC672F21C8C2E406922973CDE6EF264", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486051, "uuid": "af46ae1d-38f5-4dca-a698-64b4f6267354", "value": "98304:W+ppKoHzo474tqZI+9OlvaJtDMFQLt2wwcUcxhFrKbrt:WWzXc0H9ONCt2wjUIhFrKbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486051, "uuid": "d4b7df07-695e-4f70-a62b-2ea555f09fc3", "value": 3786626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486051, "uuid": "c9b6ed6e-9335-40ea-8fa1-9fdb20136790", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486051, "uuid": "ff7df2c6-081f-4a03-8aa6-80bc48d3a21e", "value": "da27cc5a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "014c8446-b006-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482540, "uuid": "be877a0c-6890-4b57-8cb7-8b0a84820014", "comment": "Malware payload (Dridex)", "value": "59f767f8d3532dc51fde5e4fc570e927", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482540, "uuid": "2b665672-d5fd-4961-a0aa-67e36c0704aa", "comment": "Malware payload (Dridex)", "value": "c2b6ae5b3877f95f15d07018bc1a73c1c8bfdcdbc7753430563cb4a2f0bce670", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482540, "uuid": "afade04f-3d60-468b-ae2f-4c9797f758dc", "comment": "Malware payload (Dridex)", "value": "e156796f6bdc1ad93534e21d599ca676cc9aa6fc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482540, "uuid": "e9df0c95-4ac6-44dd-a95f-6d6b0eb3c1c5", "comment": "Malware payload (Dridex)", "value": "d5efd47d4b6c5c0463a87fd7a1c9c49ae279d09ec78befa47202800e0eb1778576a868e1eade4394b06293bff68b9ab7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482540, "uuid": "b4a5ced4-78d4-4ddb-bd2e-5a91d05dfab0", "value": "16F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482540, "uuid": "65396c77-e669-4d53-b0c7-10f969a232a1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482540, "uuid": "4af05d9c-2dd7-4dcd-9a0c-a32c1022e578", "value": "3072:cIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482540, "uuid": "49e68581-44b6-4ece-9fc6-f7f8c3224afa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482540, "uuid": "6428e2de-15fe-438d-8e43-48ca3ad6100a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482540, "uuid": "65d0dc2d-e1e3-4f91-b006-ffc7f065c324", "value": "59f767f8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0722e54a-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475248, "uuid": "627bbd70-d95d-40c2-83bf-5a98998a233f", "comment": "Malware payload (Dridex)", "value": "ff89fc8572e750b61c99ff85726c2165", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475248, "uuid": "d58996d1-5964-41ee-b8c6-0973167bfa2a", "comment": "Malware payload (Dridex)", "value": "c460efaef1c2f9f9bd7aa1a74e976d69d8b0f52ec5c677b392d610c7c29f3cac", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475248, "uuid": "e8689c75-54c4-4c47-b8ad-1a5e895026a8", "comment": "Malware payload (Dridex)", "value": "690e03a5673981a043de704a01e1fd0c2750e626", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475248, "uuid": "5d499dd9-7288-4fa6-ab5a-f2f044bb2e4d", "comment": "Malware payload (Dridex)", "value": "242bf09e33dc0f77ce85001fb31891b3fbb20ebe05104bf9dc6c2878e67ceb93964e597674c550b179e6ae5b8e119c75", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475248, "uuid": "03510f7d-63a6-4615-b985-22160e8f62c8", "value": "D3F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475248, "uuid": "de1901e7-061a-423b-91a6-8e177f7be904", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475248, "uuid": "83029f59-9943-47b4-aa4a-33752ec2c205", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475248, "uuid": "c4746fde-4a8c-4cd4-abb1-3f06f147f2a3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475248, "uuid": "d559f27b-4c7e-4cc2-b6ea-26930629b17f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475248, "uuid": "dfa71a34-3714-43b0-bf63-bcd05b39459d", "value": "ff89fc85_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffdd63c9-afb1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446460, "uuid": "a6bf28c7-a405-4fe6-9ada-ab7e81c78cc9", "comment": "Malware payload (Dridex)", "value": "5875ae35b8c299dd944fb176b137866d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446460, "uuid": "f6d61ae5-3592-4f36-b52d-da27826a7476", "comment": "Malware payload (Dridex)", "value": "c4f5d30ef6929ba436cfb51b0cfb8e8c87d47d1f5ea8998b7c74f7e76d07b39b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446460, "uuid": "aabf7757-bb71-4180-8885-490f1cb0e757", "comment": "Malware payload (Dridex)", "value": "7a467001b2ebe4550a3b79231fa64c7041945306", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446460, "uuid": "fa193f16-b191-4f53-9139-3e14278f1c7e", "comment": "Malware payload (Dridex)", "value": "5207c83f3f1cc8a8f9b8102a15118e6f587f2024254c4362356d22840ac60ffe61590e8039d47bbc79ea7bc32e015a3c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446460, "uuid": "f595dcd2-6598-4aea-a96a-161874df6f4d", "value": "40F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446460, "uuid": "64d1e44e-d4bc-4188-9263-da454794c025", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446460, "uuid": "16e22803-30bf-4705-8bd2-d6dc8cebc94b", "value": "3072:SIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446460, "uuid": "20cfc7d4-89be-4bf6-aee0-202d316808c0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446460, "uuid": "38525dbf-8788-4aa7-af01-acbbb84e81f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446460, "uuid": "7b89c23f-869e-4f61-9ce7-a5614948a32d", "value": "5875ae35_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9fcc9f-b027-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620496944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496944, "uuid": "da022e54-c10d-4fd5-bd5b-ab5ffdd5e6b9", "comment": "Malware payload", "value": "e2df2017a15e2f4dca1775d0abb02a5a", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496944, "uuid": "8adf316c-1abe-4a68-8469-a30255d2c672", "comment": "Malware payload", "value": "c4f7ccdc3da14bbff634f05c1e5c0bfc30ed7ea18bbdd645e35451c53f7b63a4", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496944, "uuid": "15440308-701c-4f6c-9af6-e33f6f3ef772", "comment": "Malware payload", "value": "d0d64bbc0448623c3e480719b9eca2105a02307b", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496944, "uuid": "15657474-c7b1-470d-9dde-89000bac7153", "comment": "Malware payload", "value": "79a694a5ca748de1c1d126cd9d39429583af1f7c200e18916c98b3ef9272a4a4e5c63fd2e6c0ffbe5d63f88f1cbe847c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496944, "uuid": "24b5ccc4-c8e3-4523-ae0e-aa6bde6ae565", "value": "EE2412AAC4E6FA6BCBA3287A46D96FB37267215141F37D1CF419FB3CB604D0654810C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496944, "uuid": "24a394e3-c997-4631-a1ce-1de7a1feb39c", "value": "6144:kr5uqIO+/ENhLv5xyGBVeJZnC469axilrxDa:kcqn+crRBjeJZ369KYrxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620496944, "uuid": "5429453f-fe4a-4c6f-9430-3707f2f9e812", "value": 224602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620496944, "uuid": "fc3cf495-5969-4b6a-9ec7-3ea3bccc186a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496944, "uuid": "be313883-aaca-4a19-bb04-9f85a9fda669", "value": "copy of payment 5286602.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2b4d09-b048-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620511304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511304, "uuid": "d139d937-cf9a-4ae5-b494-4e74bc0c9d8d", "comment": "Malware payload", "value": "e1c6984149a5cbe8e4c86fd3e12b3f58", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511304, "uuid": "385cebe7-bd5d-4e29-8507-9d95121cdd8c", "comment": "Malware payload", "value": "c52185764062763e093d77ad5443d787972665aa6c62db6e63a3ecba1716cfa7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511304, "uuid": "43cc2e7c-3aa0-4d3d-b988-fcdf1c4f5df8", "comment": "Malware payload", "value": "afaaf91c99ca744898936368826590f1dfbd00fa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511304, "uuid": "72f9189e-27c0-4c67-9c8d-594ec4f16e04", "comment": "Malware payload", "value": "9c9bb90f225d64a1408d57bf7fd735c1afaf6b51a6e65fb4b8dc908b3f55a994c516666859c931ca5304c245930080d9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511304, "uuid": "c193e62e-4c78-422d-88a7-a81c520c0df6", "value": "A9F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511304, "uuid": "0ec0336e-4afe-4a28-a013-cf6144377d31", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511304, "uuid": "85fa9ff0-1b8d-469e-8459-9b4cfa4425cd", "value": "3072:7A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:73J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620511304, "uuid": "4a1f3345-28eb-4ed9-b7b0-5fff00c3dfd6", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620511304, "uuid": "f9c21293-9102-49c4-bc4e-7c554c4a2325", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511304, "uuid": "0ff84183-e3b8-4fa1-b948-c1453fddf66a", "value": "e1c69841_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096fe582-afb6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620448194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620448194, "uuid": "1bbd2c65-54be-4d37-bb23-420550195273", "comment": "Malware payload (Mirai)", "value": "915da4fede8736edeb35b689ca048ad4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620448194, "uuid": "03dd4524-f6b9-46c7-ac52-4da2b841b9a6", "comment": "Malware payload (Mirai)", "value": "c5562dbf81fa16250a7ffd26a208a1d82858706bfa438da9da4cd4dccefd5a9b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620448194, "uuid": "0906c68a-6d2f-4d5b-be78-b25caf0fa7e7", "comment": "Malware payload (Mirai)", "value": "bc6de5bb9adf51d5e4f0757f5a1af65620fd5c7e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620448194, "uuid": "096de7bb-9650-4e81-9280-e3de35b5e7f8", "comment": "Malware payload (Mirai)", "value": "4b7cc82707e2cbdc17b3ad66c37a3a9834ef0b1edb9c568e7f0065c4c550cf3071404fe70f694f28a6737deaca34284f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620448194, "uuid": "b58c1a5a-d345-4fa2-8328-0b9924bff6ca", "value": "5063F6753945F2ACD6E94078F4436EE91E1209283EDCD1E36087143BFF71B88A62DE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620448194, "uuid": "73a4b068-bb53-46ce-9af0-d88f77689c1a", "value": "1536:hWq4mXBnUM+mxqIKzHIZVBIVCCfy0K9UkJ2:9UM+/I7un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620448194, "uuid": "78151a41-6156-4481-a6f8-df386e5b3086", "value": 66944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620448194, "uuid": "7bfab34e-b801-4208-8440-b71524c8f280", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620448194, "uuid": "9fdae8f1-4759-440f-acf7-333249569f0c", "value": "KKveTTgaAAsecNNaaaa.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55803e97-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "fb14b0a0-4ec6-41d2-a64d-f6ea24133304", "comment": "Malware payload (Mirai)", "value": "f11b4dcb86323cce8c170f1df16d28cc", "object_relation": "md5", "Tag": [ { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "4fdff71b-02a8-4e1c-ae27-3f6f09814012", "comment": "Malware payload (Mirai)", "value": "c5e0301d7e29e7b8e7979a02b7cc3e17998ff8478b66d974f452940bd9d2f60c", "object_relation": "sha256", "Tag": [ { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "5345f1f7-b4b8-4e73-bcaf-8121083ec211", "comment": "Malware payload (Mirai)", "value": "ec0bec214616975f23a981f9d4608b7f99f89008", "object_relation": "sha1", "Tag": [ { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475380, "uuid": "fb36fa79-2169-426f-8071-3b7e6f6827eb", "comment": "Malware payload (Mirai)", "value": "fbe2dc3dd98c3dd4cc98b433aa7c02c8bc2f3ed9ecad4d66eeb1f39db3f5638d5074eed0f1765a8478c0110d9885dbf9", "object_relation": "sha3-384", "Tag": [ { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "e0753d39-9cf0-4853-9af8-a0c92c50f764", "value": "89633A99B401AFBCF99FEAF941160A0DF421E25460930F23B36BEE937D711A1DD06D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "67d9f8e4-c471-414b-aa9f-000ca32dd006", "value": "1536:tTg9OuTO28DopXYpHrOmLyahWOvztSmfn817Z:my28DoRYFrh5s2SGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475380, "uuid": "f1d8e3ac-556b-4448-9ea5-21c4567141ce", "value": 67220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475380, "uuid": "37337930-d28a-4da1-9cf2-780355a5ce36", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475380, "uuid": "5167a842-e02c-4525-9118-970b209ba2f1", "value": "KKveTTgaAAsecNNaaaa.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b7e026-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432053, "uuid": "2568eca2-b2c9-4b0f-b92b-fa196a1058c6", "comment": "Malware payload (Dridex)", "value": "4d02c80a0f653c4f9bce5bc3b505e67c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432053, "uuid": "7a4afca5-5af7-451c-9fb1-c7c20671c0a9", "comment": "Malware payload (Dridex)", "value": "c5eee34c8eb0c00c7aa5c358fd6efd8b6b415522234ee688af2e7fcfb08d6275", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432053, "uuid": "d4fb6f24-6fa2-4244-ae06-26ee0e87e7da", "comment": "Malware payload (Dridex)", "value": "625911962f52f310c50434dcf11883eb031d1aee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432053, "uuid": "780f3ec3-be08-4f79-a447-ba32e97eea06", "comment": "Malware payload (Dridex)", "value": "3a5710f70a5268da768ddd81719db7f29686ffd29c231acbac5b8d66a562096eca75fa323138b5f2e280a376f931bc35", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432053, "uuid": "78169320-33e1-476e-9e39-0a18b1c67b4d", "value": "79F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432053, "uuid": "dd8d8462-b83a-4da6-a619-298b5103453c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432053, "uuid": "2b3b4ef2-20e8-4fdf-baa4-b45154cd9ddc", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432053, "uuid": "9728fa6b-b90c-4f15-a0b8-ce27a5a7ae98", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432053, "uuid": "9e9be3f2-aa17-4115-8f1d-71202c5182fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432053, "uuid": "53049087-c732-4887-bb88-747112e27985", "value": "4d02c80a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5239ad58-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "39dbf289-f086-4aec-89f4-cfc9cceae0b5", "comment": "Malware payload (Mirai)", "value": "83f1ccf69cf9805af67f312728d1e21b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "9bf4d042-e652-40d6-82ba-2b178fd4e576", "comment": "Malware payload (Mirai)", "value": "c66770b327afa83e5c969cb0c82f088eddd1c6762cc68fd0de876a40fdc9b661", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "164b3cfa-73c7-4f29-973a-d1850a2f71e1", "comment": "Malware payload (Mirai)", "value": "8b4d2548a412150ab37ba41965d26dcb408c2d2c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "553eeab9-2cab-4500-a771-82c13f4598e1", "comment": "Malware payload (Mirai)", "value": "a08ac5654d92a2c16023e1f91d99208262a15c31d7bb15b69da01e7e8f3887f59c363a8fba334586118f70a39a6c0bea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475374, "uuid": "c26ac988-3424-45c5-9a74-1d599b36682b", "value": "02534B0277684F07FAE61AF4243F1BE483BEED8025E4B588690FC7424635E334999E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475374, "uuid": "7eece80d-4447-471b-b9e4-1f4f535d1939", "value": "768:Sr5Eg6nb5usRVQq8WTUqYhcBJcIGsllk5M9Bv6GG4TlW2c5sjgi+DDiZ/vIBbsVf:2KbpuqJlzk5xGpJgbDOZ/vIuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475374, "uuid": "2891e07c-5434-4496-8ec5-ffa73f47580d", "value": 66468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475374, "uuid": "9bcf714a-4ead-4707-939b-d3737f030f43", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475374, "uuid": "a57498b0-967e-4de2-87ed-56e5738714b7", "value": "loligang.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ee66bc-afa1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620439277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439277, "uuid": "8137aaea-2b4b-41a5-9022-437e9fb8b9e7", "comment": "Malware payload (Dridex)", "value": "4d4e65879474c60d3fa8ad0f81b78765", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439277, "uuid": "4fd5970b-d89e-4bf0-96d3-072318266abe", "comment": "Malware payload (Dridex)", "value": "c733782075e2118e465d15a8b5d4df1befb8c940969cb1816e49036e67838b8f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439277, "uuid": "b2a96b1d-e866-4658-b453-d267597bb707", "comment": "Malware payload (Dridex)", "value": "7b39c1ed05d98e47ea84b99b5459b528723c1afa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439277, "uuid": "f2abf886-f875-4b0a-b318-20401f57aa8f", "comment": "Malware payload (Dridex)", "value": "738149b3e645955ecce77b41a477d8b48c543a20c02edb988267fdfd489e607839b74db9ba579cc4e987041776f5b927", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439277, "uuid": "4c213ab6-c460-471c-b33a-3ce3f4835a0f", "value": "2BF3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439277, "uuid": "9f81ba8b-4a58-4fed-b237-e5307f69a6b8", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439277, "uuid": "9ab91783-5799-4775-9686-3a90076f3b14", "value": "3072:ouFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:o0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620439277, "uuid": "5637a97b-eb5a-4313-9cbb-82c6c3d2659f", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620439277, "uuid": "37e8aa95-9ab9-4272-acbb-4bd4f97c1439", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439277, "uuid": "08f19477-e1ff-419f-89c3-3c07d7de28ad", "value": "4d4e6587_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc459ab-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435690, "uuid": "1644f56a-27e4-4d65-b812-f2c3b8a8d298", "comment": "Malware payload (Dridex)", "value": "d32d15fa9c62acc71f168e09bb9cc423", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435690, "uuid": "50b838bd-a074-4049-9bec-8da908bb9cc2", "comment": "Malware payload (Dridex)", "value": "c778ab8e05b7e27ca8cfaede372689d6b88fa5b6c8e7ff56bc2ddbf57adba185", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435690, "uuid": "70916863-1b85-4c9a-aa52-9c89b31488e4", "comment": "Malware payload (Dridex)", "value": "07c802183ffdbddf87f42d703352f557a92cd653", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435690, "uuid": "53c4d2f7-16ca-468a-a778-84720e5258f3", "comment": "Malware payload (Dridex)", "value": "dffec737693f4e14d5071288c95c51bb35dd579cbd6955e2ec9f26213eff1743f40ead1721105548fe25a06450f24512", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435690, "uuid": "7ce580bb-9a85-413c-9e99-61daf7dc7c45", "value": "39F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435690, "uuid": "58c7c735-cc07-46d2-a2a3-0e4d368b76e0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435690, "uuid": "c5cec99a-e8d4-4eb5-a1be-d5caede79489", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435690, "uuid": "0ffb9080-41ac-41db-b321-d5597333c404", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435690, "uuid": "a8be00a2-da82-486a-9048-10535628b80f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435690, "uuid": "71687013-b6e1-4a7e-a6d4-b74e566d0376", "value": "d32d15fa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105915a8-b006-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482565, "uuid": "fe060786-4217-4fd5-be0a-eb62a0591ac9", "comment": "Malware payload (Dridex)", "value": "b0908edd9337a630729909a62266fae8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482565, "uuid": "1c5a147c-4660-4d50-8f43-8db512d3c84d", "comment": "Malware payload (Dridex)", "value": "c78a63069e2ef4693448fdd341bb182d39a3c1be0dfa346320948428f0a6b7dd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482565, "uuid": "0697842f-f34a-44c4-9935-c7dd63aacd80", "comment": "Malware payload (Dridex)", "value": "f492b6e1b37caae51435a9fef9338ce5c7b15d09", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482565, "uuid": "88e633f8-3dcc-4ccd-80a3-87b2edf80966", "comment": "Malware payload (Dridex)", "value": "e0bb497d1880531657a5d869c3c6656c686527d631829624d0b3e6c2eb77ec3f03ac95eede9ebf8408dc3d2b353f774f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482565, "uuid": "3efc2a0e-6421-42e9-9dae-85ea2911144c", "value": "86F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482565, "uuid": "03540dc5-2307-4962-b9ed-11c0c211b66f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482565, "uuid": "cd288b0b-5c44-43e1-a103-328865350f6f", "value": "3072:Xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482565, "uuid": "4797d137-845e-468c-8372-51d632dd07b5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482565, "uuid": "6911835e-8913-40dd-803f-c83e49a8086c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482565, "uuid": "18163eef-30c0-47eb-9d0c-67e9c4ac0fc4", "value": "b0908edd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ad659b-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460881, "uuid": "6070fe66-9b1b-4941-99bc-ff049ad5c89c", "comment": "Malware payload (Dridex)", "value": "ec87afe3d01c0d7693a8131d98898c95", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460881, "uuid": "5e87bb7f-2ef3-4304-853e-2969387b2784", "comment": "Malware payload (Dridex)", "value": "c7e7d6906e42b4cef05af060186fde1d3f4e02bd2fe359bbbfaf3bad043d00af", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460881, "uuid": "5b40e9ef-0537-4949-b77f-962f533c2111", "comment": "Malware payload (Dridex)", "value": "ebc1ecd12918b00ae491850a547f500388f9044a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460881, "uuid": "ccc3a314-ba8b-4c7d-81c1-abd5113f7808", "comment": "Malware payload (Dridex)", "value": "9625e5c07aed3671e36170021656e7de217860cc4cb4abbab53ee66a07d5a38d0230e17691a66cb50133cba61b5e817e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460881, "uuid": "086de744-fdd2-49a4-94bc-19e281aeac95", "value": "6AF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460881, "uuid": "d2e381b3-9e97-44b5-b2a1-b17760759ae5", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460881, "uuid": "f63a8a7c-15d2-413d-b192-877acade91c2", "value": "3072:WiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:NeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460881, "uuid": "e116f7f0-fe90-462d-90b1-19dbff35c068", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460881, "uuid": "0fd29bd9-96d6-4cfc-ab33-b6741b95e067", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460881, "uuid": "35336f3d-7af8-4e2a-a7f3-83e07538bb39", "value": "ec87afe3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5e5b05-afdc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464518, "uuid": "918e846c-e4dd-4546-b713-d3885e34728e", "comment": "Malware payload (Dridex)", "value": "0b9d3585f18364450e9e5f35d4b0e25f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464518, "uuid": "b113d13f-e3c4-4169-a4db-9e08366cf49c", "comment": "Malware payload (Dridex)", "value": "c7e9c49f37b070fdc1d8177dceaaa3b5ec7dce789efdaaf80088214c0fff47d1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464518, "uuid": "e17c8116-80f3-4ba8-aeb9-554dffbcc853", "comment": "Malware payload (Dridex)", "value": "bb164a8fdb9d276281917c2521064cbdddad1be4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464518, "uuid": "5e7f1898-9e97-4b38-bd60-51676be5c863", "comment": "Malware payload (Dridex)", "value": "746a197ed556e1d4292fc00ed7185c95b578138ff8f975c24fa0b3ea3a34513d3b7ac91c62e9ef726b9ff6600e124133", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464518, "uuid": "744b9e19-6a9a-47b3-81b7-31b9ad1990b5", "value": "8CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464518, "uuid": "75ed1b10-3a18-4782-bfc3-d7fd9e35f1ae", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464518, "uuid": "14bf48b8-bf98-4787-912d-16402ded206b", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464518, "uuid": "c902892d-98ef-4f0e-89e2-a25a541a9f3d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464518, "uuid": "a77ac735-6093-4e82-b940-f70aa88167ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464518, "uuid": "76219e82-5e8f-44ef-a0d8-589f39c70750", "value": "0b9d3585_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31034f30-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486056, "uuid": "4d4bcc49-1c85-4a9a-a0af-dd94fdb6aa32", "comment": "Malware payload (Dridex)", "value": "0b490e85ff20a4c226e0338147d5632b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486056, "uuid": "76c9b5df-9f1a-451c-b612-8cac9931a61f", "comment": "Malware payload (Dridex)", "value": "c858f456e8691549c8535df4f29f8d8d21067267525240b4dd1ebccff9be6499", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486056, "uuid": "fb4eee81-9769-4629-8885-2c4fdc7b7d4c", "comment": "Malware payload (Dridex)", "value": "6b510dade8e692e8339834966672cbb63364db7b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486056, "uuid": "ff567c88-96c4-4475-9cd9-0905d5625ee5", "comment": "Malware payload (Dridex)", "value": "b1edd0ccfec136e29c56dd9d1ca2a241d0d2785630c42e57c5e717569eff20255d129943161e082625d8e8c1398286d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486056, "uuid": "75d60ead-c69d-4828-abf4-ebf995dcfb18", "value": "E7F3C141C9C5CCF0CBE36C364795963B3628B941995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486056, "uuid": "9264a23d-5dc0-4ad6-9de5-f0d5928b8fef", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486056, "uuid": "259bbc7b-acee-436d-941a-8fcc0a5928f4", "value": "3072:NuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+yX:N0czbty9uiaJlnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486056, "uuid": "5aacc99a-017f-42f8-86f2-6afbd3469e6e", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486056, "uuid": "ee718bd5-a192-4e79-8512-5e308058f8a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486056, "uuid": "28a34839-b759-4a02-b4a5-b056d8d13446", "value": "0b490e85_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852e88bd-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460857, "uuid": "123b27ca-a2e4-4a5d-9736-61581ad946f0", "comment": "Malware payload (Dridex)", "value": "9eaaaf95e8aae225ea9dc5c953075a61", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460857, "uuid": "6d25e544-fa92-4107-9c69-d35c81154b76", "comment": "Malware payload (Dridex)", "value": "c87e30a53c030e8aeadadbba3d1b1b2261f8a64a40c9a316eecdbbc43be41cc0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460857, "uuid": "5033846f-68de-4926-be8c-a5deb4765cdf", "comment": "Malware payload (Dridex)", "value": "d85655fd05eb265896c281363f002c54a6a68c0e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460857, "uuid": "73770449-eb64-4ea7-ae24-77dc781c0dfd", "comment": "Malware payload (Dridex)", "value": "d436f194f8a0edbe89e8e4bb8027ead38bebf2a4f130ac34c630b4732374c3aad296a8dd7db198caa6f6b268531cdf13", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460857, "uuid": "2cba7740-0f96-4e13-b6a7-525442595586", "value": "D9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460857, "uuid": "8da6eedb-65c8-4c04-956b-16477a5e6ee9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460857, "uuid": "faa35ac8-9cda-434c-959c-21b793de80d1", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460857, "uuid": "350db2ad-1c34-4f3b-ba48-26fb96cb75ee", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460857, "uuid": "ded0bf38-1c46-4586-94ce-1b069fa11b46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460857, "uuid": "9b1f76e5-732f-4ccf-becb-9c66562475b2", "value": "9eaaaf95_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd06d6f5-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435637, "uuid": "90f83cc2-feb3-4bbf-befd-46aef5826458", "comment": "Malware payload (Dridex)", "value": "dfc35c58b2e9c4ef7309c64ca6533fc1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435637, "uuid": "82d5f6cc-4b7f-486c-aed5-50b89c3eaa62", "comment": "Malware payload (Dridex)", "value": "c8a1b920e0dce170867f19419008c7d4bd1a91fa3520f8a50d16b7237970d032", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435637, "uuid": "7b3457c1-ab1d-4e59-b4b2-303c79ea04a4", "comment": "Malware payload (Dridex)", "value": "40893bb78a464042b3b5cd015c33ae2b8f76e788", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435637, "uuid": "8edaf049-53bb-4df2-80d8-12c287725d95", "comment": "Malware payload (Dridex)", "value": "94b56c864e9cc266eba99e79106e02ff4c353c2bc2ff94ec328c5a5c19dd918a7975b785981b3a103bb4e703a1f22a6e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435637, "uuid": "17967b25-fdfd-4a78-829f-4cddc6e745b5", "value": "65F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435637, "uuid": "dee25110-8e40-4cc9-b15d-57d68f90d266", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435637, "uuid": "2ece1355-2428-4b1e-922f-d45613a36530", "value": "3072:piFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:aeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435637, "uuid": "bb5b29b5-92a6-4350-a02a-585b8714b937", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435637, "uuid": "66bad292-c89d-4120-aacd-51b3def98a80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435637, "uuid": "72752917-05b7-4ea1-b3bd-ad1a3278b0d7", "value": "dfc35c58_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1cebd7-afa1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620439261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439261, "uuid": "3837fd3d-2abd-4d57-9708-0fd5b159f023", "comment": "Malware payload (Dridex)", "value": "a6a74a9498d8807f65f93e8b87a829af", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439261, "uuid": "7a584a1c-fe83-4e3e-88b2-338925a7f2e5", "comment": "Malware payload (Dridex)", "value": "c8a45b1b291debc37459515eea1f448b06d4d11294855c0622b615084a16a217", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439261, "uuid": "bfac3488-8879-49a9-9dde-35d0cdc20835", "comment": "Malware payload (Dridex)", "value": "1341c53029372e6cb25cc055adc689606c8604ed", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439261, "uuid": "fe83e408-757b-42f9-8a47-f0451eef5391", "comment": "Malware payload (Dridex)", "value": "067884102a8d093f50285d08403a1859ad2f40cbd60e051db96706c74eaca88c6bdb5007230abc4843b4e16e610b8dcd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439261, "uuid": "3d27b4b3-72b7-4cc0-9ca3-910daa832bcd", "value": "43F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439261, "uuid": "d8655bde-f844-45fa-a973-adff52f041c7", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439261, "uuid": "aaceb972-0be2-4950-8d6d-4e1f40721ccc", "value": "3072:ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620439261, "uuid": "8131f93e-00c3-4eff-9b2d-b9c7ebac4c45", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620439261, "uuid": "21aca1e6-313b-48b1-9b91-471b141a762d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439261, "uuid": "284a224b-c941-4f61-81a4-311ee9354178", "value": "a6a74a94_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb50b7a-aff3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620474430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620474430, "uuid": "21ce8304-b53c-41c1-874b-ff06a2a7d61d", "comment": "Malware payload", "value": "6e9dea3520f58469b611e45b64f12904", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620474430, "uuid": "659cfcb4-0531-45bd-8db7-fb6759546cc3", "comment": "Malware payload", "value": "c92a215db24072cdb65dc6f2ab07a5862f23e79154bf83f9c75b9c872a4cbb41", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620474430, "uuid": "b9d61880-e936-4f24-868b-38219ad02632", "comment": "Malware payload", "value": "5e39f3f6022cead3184eec00388d10417090739b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620474430, "uuid": "ad12a699-476c-4544-9ba6-4602f9dbd69f", "comment": "Malware payload", "value": "b911261d8cd8e0d0599bff2633214b9c8d26b60492503df867698153feb594fa664e896fc1eda29a71512cf22c91d4ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620474430, "uuid": "0968213d-828d-4eb6-9447-91470544b50a", "value": "39C5BF12FB8280B2E8C6017561FB9BBB4D396924A734C5C3C7D129F589311D2A73F79A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620474430, "uuid": "40db531d-139a-46a5-91ef-c944385b2a16", "value": "1a6416c21a8f7096dbdc1ab9df9a83bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620474430, "uuid": "365e3e98-6077-474b-a8b1-aee1325f07c8", "value": "49152:o9n7A3tSQVFdbeZeLE6aC+deEZQPHuzJVO19Bc+OuBlk6Cgi37:o9n7+p9E++deUYUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620474430, "uuid": "aa504086-bb78-4070-a708-5ac483c412c4", "value": 2636288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620474430, "uuid": "4f00703f-f2c9-4734-b69e-f105e1902ca5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620474430, "uuid": "3ed25d4c-6d6c-47ac-aca5-200c11f3f7d0", "value": "SecuriteInfo.com.Variant.Doina.12980.22107.6684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744ac84a-b051-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620514945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620514945, "uuid": "50375091-d93b-485f-aef7-2facd8ef29f0", "comment": "Malware payload", "value": "8bc7773a0150a40f04e05ed6bec8b4c3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620514945, "uuid": "f8cf6008-3f01-4f62-bf12-58816e6e908e", "comment": "Malware payload", "value": "c9611a2b6cb074644dcdcf27dfaaf3adf42b734c46a7292b6b8d5b37f686afe3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620514945, "uuid": "81342ac5-3e1f-465c-84a4-9215362824fe", "comment": "Malware payload", "value": "3cdb305ae9e26aac136b32fa9fd2cb9ce1eb8365", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620514945, "uuid": "e6c589a1-8304-4df6-ae8d-144bd83b3bc4", "comment": "Malware payload", "value": "5ec307904225b2c6cb45543500dff9e57a6566cebb86313ff5d89dfefd6fb0d91fbcd629c23daec02d1f35c45fe67c1b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620514945, "uuid": "d50871de-1668-495f-a591-94095a56c080", "value": "A104D38F19471BC6D1F30DBD39B26AB151B8429612131DC858EB402BEC3E2E6D5FEE85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620514945, "uuid": "3cccfa4d-c142-4003-8645-e18ecdf1ad15", "value": "95e6f8741083e0c7d9a63d45e2472360", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620514945, "uuid": "d414fcb7-1f57-4cdf-b939-ba734dd3cf5a", "value": "3072:xbX8GDMTkDjY50pO2ffwxFsCOiPhzTkDjY50pO2:xbX8SMTGjYsO2fSsC1zTGjYsO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620514945, "uuid": "7177eb5b-f946-40ae-8c09-31e544a27e72", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620514945, "uuid": "2e43e6be-1df7-47f5-91cf-d6e9d3a1a1a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620514945, "uuid": "873431b8-5ec1-4782-a90f-8267d7255a9c", "value": "8bc7773a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699a760d-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468112, "uuid": "9d03972e-5b52-4fc3-ba23-f873539518a9", "comment": "Malware payload (Dridex)", "value": "590cd374aa74dd035eacff4e80d567af", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468112, "uuid": "9656227d-3a5b-4ee6-8160-04ff415dc444", "comment": "Malware payload (Dridex)", "value": "ca17b817cc9a4c96a0fcd225d8d5562bf8b429219ffb5871c9ce0c325cf04956", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468112, "uuid": "02189ce1-82bb-421d-a64e-2767ac6c02dc", "comment": "Malware payload (Dridex)", "value": "b1097a0bcb032c04662268452c361561c5450d10", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468112, "uuid": "34b28a7e-2512-4252-ba08-21a26189e030", "comment": "Malware payload (Dridex)", "value": "e589378c759789b64320ea77ffd9ff8742b7387ce6cead389bc739e40592ece79db1b0a90fe763a6f6457239cde5cafb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468112, "uuid": "cf5bb66c-71e5-49b3-8bfd-2316683a2f0d", "value": "55F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468112, "uuid": "2e2c34c1-383c-4c81-b9f1-97d0e19e2a97", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468112, "uuid": "3a134229-daef-41f4-b53c-376367c9eae1", "value": "3072:ziFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:QeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468112, "uuid": "f50719ca-7118-4889-8f35-80c962786e94", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468112, "uuid": "e1a9ebbc-7376-4008-808a-0c1ff85d0c47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468112, "uuid": "a6c50ed5-1123-4961-b828-ff122c88701f", "value": "590cd374_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a795c21d-afc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620456190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456190, "uuid": "175d7a3b-9e1c-4d5f-a9c6-685b7e8f242f", "comment": "Malware payload (Formbook)", "value": "96b356e875a0578b468ae325279bbbdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456190, "uuid": "daee8413-242f-4079-9f88-214d16e9a3e5", "comment": "Malware payload (Formbook)", "value": "cb44a6f7264ae4707ae8b0db82d0f62766f996f7bd37586401e11e5bccb30bd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456190, "uuid": "04e338b6-89c0-44c3-ac09-96edfe15448c", "comment": "Malware payload (Formbook)", "value": "6f3ab69ca49850f49a8b67a76c7788e9988868f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456190, "uuid": "08884351-6e99-45bd-8e22-b7adc6c9fff1", "comment": "Malware payload (Formbook)", "value": "f25eaa8d59bb9cf23e86a8ed2950377a8e4ef3edb1e1678b55ad141aec05daa97acb6c1ac20a0a697b01c0aed70f64ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456190, "uuid": "de1e812b-cd97-49c3-a4d4-f408f53420a3", "value": "B1E4027D23DBAF11CAFE96B81991910A03357E464D53E33CEAD871F609B3790C9582A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456190, "uuid": "3038c69c-3686-4d13-9675-c6880978a585", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456190, "uuid": "92812eea-7b11-4491-962e-6dbc038e5091", "value": "12288:E+99sUxo3CskWcQm0RkU+xzenMSV6zoYNSvw6d0CqTA2eZjtviw0AMsmJ0+a8UuP:9KUIsR0RL+xSnMSAE696d0E2eBtviw77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456190, "uuid": "b4a7fe1b-0da0-4509-887f-648156ffc993", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456190, "uuid": "a64fee95-c533-4371-b4e1-d4c0471cebe0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456190, "uuid": "d612eb9a-418d-4ec2-8a52-0c75e55005bd", "value": "Purchase Order #330716o.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99bb6252-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460891, "uuid": "b4198bba-498e-4801-8919-848d43d1135c", "comment": "Malware payload (Dridex)", "value": "6e5f8c3e7959092fd171e555420cdeaf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460891, "uuid": "949091dc-5509-44a8-8500-6c334c9698ba", "comment": "Malware payload (Dridex)", "value": "cb8f70de44af40f62b800383be99c621f423a56e393ff4c189681f883476fbd5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460891, "uuid": "12ba2b08-042c-4985-bd0d-8ffe5ab258c1", "comment": "Malware payload (Dridex)", "value": "d6b3bc7b7df2f3c049605cb6e63f27009b9d6886", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460891, "uuid": "d872d010-ddfa-492d-8c8b-d64ddf643a1a", "comment": "Malware payload (Dridex)", "value": "c27e4a9d6c0b77c1dac6b6e62356abc1cd45ec2eddf781e7e0a7507eed11921ed6c3eb1ce8e827f0be61e8c6deb74290", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460891, "uuid": "76bd8caa-a26f-46b8-9599-65833dbc87cf", "value": "BFF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460891, "uuid": "07c86536-361b-420c-9aa6-bed0141f9f51", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460891, "uuid": "78b26d10-3b72-47f9-ac20-0f791de5afdf", "value": "3072:oe45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:d4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460891, "uuid": "a27975ad-5994-47ac-9fe0-63c4a2f13221", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460891, "uuid": "3670ce2b-61b8-44f2-afdf-4a6e6052ec83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460891, "uuid": "f89a3b2b-7135-4a36-886a-695602bb46b8", "value": "6e5f8c3e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc6376ef-afca-11eb-abe1-42010a9c0039", "comment": "Malware payload (BazaLoader)", "timestamp": 1620457084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457084, "uuid": "4873cfc1-a4a4-4548-9052-a327cd06e709", "comment": "Malware payload (BazaLoader)", "value": "0c1db79e9943a2e3b76d5f7b808c13d3", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457084, "uuid": "5bf60c69-39b9-4b94-8b2f-5b2e54f32f8e", "comment": "Malware payload (BazaLoader)", "value": "cca0563ae1aac9447ba5e3f73cafc63a21671e478dc198695db6c698a2a17d2b", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457084, "uuid": "053bd7a2-e697-4a4d-a8d0-84da3e5d7ca8", "comment": "Malware payload (BazaLoader)", "value": "570ae5bd55275cbca4ecbcdcd76249a80fb9902e", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457084, "uuid": "f25b0e14-ba17-4874-823f-c1bcd7468418", "comment": "Malware payload (BazaLoader)", "value": "2dd8a96236ef29ee41481f1500f873c26fb6c0889934abe423c1e6f561a8548380a4608e73a98bbcec8feacc7eadb1c1", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457084, "uuid": "c2092b8e-3b22-4ca1-9699-9a8bdf2a143c", "value": "93E4A043F1C210E4D13FC9768BE58233FE61351359B9EE1E42518BC26E35BA4677AB0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457084, "uuid": "b7c6bf3c-2357-4ec0-ab53-067568d1e2a8", "value": "c15dc53097faf62f7e80be185232590f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457084, "uuid": "62c90f2d-6094-48b4-988c-be7d132aa0de", "value": "12288:9SqBYvqYqlFdZD+ZXa/Lj5yGquIe+aBUIO27qpuuFZdGEwP:km3NAwLdyGqpe5BP5suedGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457084, "uuid": "157b1509-75e7-4999-9cbc-d522e826cc74", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457084, "uuid": "14ca4427-e28d-4c3c-889e-f403e4b666d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457084, "uuid": "ae07e80f-c5b4-4668-a5ed-42cbe25eed42", "value": "0c1db79e9943a2e3b76d5f7b808c13d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802402fc-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460848, "uuid": "096a2638-6059-4934-8ffc-afc6bdcff548", "comment": "Malware payload (Dridex)", "value": "8c95a2b7efe7bf7d2c5aa005c1ebed05", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460848, "uuid": "38cedcb2-009d-49b0-8d03-a4ced9826cb7", "comment": "Malware payload (Dridex)", "value": "cd334f8f42f3bce27230a3d206f7aa6f5ab6d81a874dd89637a30c20499b1ace", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460848, "uuid": "7b1acf13-f196-465d-8d57-121c2369de78", "comment": "Malware payload (Dridex)", "value": "e31e8ab5844b99727a0d60f07e280dd166d2a34c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460848, "uuid": "778be5a7-b064-48ec-8c0a-3ee2db9694e7", "comment": "Malware payload (Dridex)", "value": "92ddc81bc3073ca9ecaf69ae1044cc8af3587a6ae68ef1a661f96557f2ed36b6b84babc97855c07a2a25ef3fda48f103", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460848, "uuid": "d68bd925-99a0-4f86-a9aa-df4b73a63b8e", "value": "01F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460848, "uuid": "9ee476b9-88d0-4c60-8fe2-71a445fc1319", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460848, "uuid": "a74fff73-e755-4e49-a80d-87c77d2ae3a4", "value": "3072:KIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Dc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460848, "uuid": "121504f6-9d91-488b-ad8e-9d9bae729955", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460848, "uuid": "1acd61e9-0e2d-4143-92f7-64922bf645a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460848, "uuid": "80a2a44e-e994-49e5-9071-a568998626da", "value": "8c95a2b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b8af10-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475377, "uuid": "19fa75a1-5531-4612-87c6-5b8dd0a4c1dd", "comment": "Malware payload (Mirai)", "value": "1d525662030f84350652a546b807f971", "object_relation": "md5", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475377, "uuid": "aef2660d-0516-4133-af12-7d461fc7b070", "comment": "Malware payload (Mirai)", "value": "cd6691aea67ec9cca45df0d52bd349598e9eba523991958db601676cb6141c64", "object_relation": "sha256", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475377, "uuid": "681e59a5-0642-4298-a6e2-ec397a75e078", "comment": "Malware payload (Mirai)", "value": "bf27ab4f758e708cee00bc0ff04b31532d742ede", "object_relation": "sha1", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475377, "uuid": "1fd45ff7-fc19-4f12-9746-9210105e3912", "comment": "Malware payload (Mirai)", "value": "c769a98b100138ae9bd9267e199a2213d4154fc114b8b347632a99778c4effa1ddb5f5250d8c774887330a62bfd2715b", "object_relation": "sha3-384", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475377, "uuid": "8475b797-af48-4cb6-9cb0-478d9bf936e6", "value": "0693734D3E219F7DFFAC823887B75A21A64823DA66E1C585D05CFA021E7034E741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475377, "uuid": "1c1c3e04-0a24-4476-b0b0-f38d18524397", "value": "1536:1YRdsnDd6C6gb/ZVyDYjMbwqZ9f0vfwW9ufY1C+KBtyRirfXDOiOv3J:CHsnD8/gb/zyDv9f0HD9FC+KBtyR6/Dg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475377, "uuid": "7c77bd97-9d4d-4f43-9b6a-469e354c6ee3", "value": 89332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475377, "uuid": "6b34d40a-e587-4153-a2c2-d58c3e41786d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475377, "uuid": "b982ef95-0fd1-4a66-bccb-d3bc38130ec0", "value": "loligang.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b403c67-b011-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620487523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620487523, "uuid": "2cce4a78-1d81-4cfd-847b-fc2fe6347a88", "comment": "Malware payload (njrat)", "value": "3daf792075ad0eeacae676b0d7f80a68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620487523, "uuid": "c2aa05d3-8610-4626-a693-cd9a08cd6036", "comment": "Malware payload (njrat)", "value": "cd6e990e83a947ee95fc38e33ef891fcd2adca0c669eba160cca49895471663a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620487523, "uuid": "e19c8617-d58e-4101-822e-41a9ccfe0275", "comment": "Malware payload (njrat)", "value": "7b2da0cac13461f09bfba7fad96253e517098ce7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620487523, "uuid": "7ed8d734-a1d4-47a5-b89f-5e8c3b6914fb", "comment": "Malware payload (njrat)", "value": "c0dda60df98a927c1fd141b76ec140eaa3bd2a347a7947647606cc4debf974c46134de36937fcc3423421f473efb761e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620487523, "uuid": "a468329c-fd07-420a-b13f-a3191dc6b022", "value": "7BE21A6DFBF64466D1BC0AB50571950003B4E103E523F77E4ECA24E62B6B6D84B98DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620487523, "uuid": "8b4d1e97-0fc9-4c44-b186-ee17dbff390a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620487523, "uuid": "71fc84ee-4e8e-469d-a4c5-956c8c7e2a01", "value": "768:9PwoqkZlH/azx1+ta+q3U97v8+QmIDUu0tioYj:w4qSp7QVkwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620487523, "uuid": "3f781735-69c3-4f9f-bde6-c625da8fb263", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620487523, "uuid": "fa54b3fc-ac48-4c59-93d2-d48cb90149ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620487523, "uuid": "972f9056-fa7f-4ed3-abaf-650e123ffe75", "value": "3daf792075ad0eeacae676b0d7f80a68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53dd17da-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475377, "uuid": "acdc55b9-18ee-498e-961c-5cc78b0c41c9", "comment": "Malware payload (Mirai)", "value": "332e14b768ab3a0ab2dd2448c16f582a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475377, "uuid": "471ec76a-42f3-4c62-9904-3b5452bb84dd", "comment": "Malware payload (Mirai)", "value": "cda5caa7c4e27cced84adfaf98671e17d11a803d7fcff48dc55a548172973111", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475377, "uuid": "d8a08f08-a100-4aa0-ab2b-ee217ab72c1a", "comment": "Malware payload (Mirai)", "value": "61c63cd5b6d417a6a1fc80f7df68b3ca83f1474c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475377, "uuid": "7d22c775-e09e-4cee-9395-26b1a2dee06a", "comment": "Malware payload (Mirai)", "value": "7773eecf81d8a66a535c048feed67bde6e7fbb850640fdbd727cae5d889ba59527aa0b738ffce5b99ffef181e76ba78d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475377, "uuid": "d4f1557b-5fb9-4ff8-ad30-93492fa6802e", "value": "9F244B8B59A11EFBD208BB716C7A2F34172CF1211F0F05AA683CC574625F6DAB05FA58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475377, "uuid": "21bcf52d-bfd1-4c00-8f78-ca1f6829652a", "value": "3072:OvAw3RA+vUbKxcmgKLR+X6RYlzAfUNtKg9aL9z/8IjReq7NFQ:OZS+vUbKVgMRFRAcfUNoP8mIAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475377, "uuid": "6d370f88-58fb-4882-b74c-ce94527b0200", "value": 224913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475377, "uuid": "c1508dca-8934-4b7c-91b0-ef727ed261f9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475377, "uuid": "9c959b16-5036-4666-9e27-864edf9e1cc2", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9611cff4-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478924, "uuid": "342935b4-2638-49db-93b3-da62b793b2f5", "comment": "Malware payload (Dridex)", "value": "112bdbe7c5b82bc0ae93c12ec3c0866a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478924, "uuid": "033e441f-07ab-461a-869b-81036b54c914", "comment": "Malware payload (Dridex)", "value": "cdbe211206346da9d37b81074187f31b9416cae095ea13a861bf183f76d09d87", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478924, "uuid": "df53ef93-05e1-4de4-a7c2-f2a297955a36", "comment": "Malware payload (Dridex)", "value": "31959c51a78c8d6eaee077de0b8a6d6f1a7a763c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478924, "uuid": "5e5222c1-5e66-4477-873c-419b5438c7e2", "comment": "Malware payload (Dridex)", "value": "ee164b98cbf049b2ff27a129750f6530f4a6cb17c4b0f1252cf79421f5cfe9f664b0071ff7cff499fa70992bc86e52db", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478924, "uuid": "bb25e11c-0b75-4117-8b6a-c29c9ee05cba", "value": "E9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478924, "uuid": "572fcd08-49ce-4d10-9b2d-346211280d8b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478924, "uuid": "058504ca-22a1-47f2-b5bf-bc0e2fd981a9", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478924, "uuid": "138b36cd-1384-4289-b000-4e599f685bd3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478924, "uuid": "931fc78e-684b-455b-8bfe-8a0ad11e7278", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478924, "uuid": "cda7612c-6862-4d2d-b396-19f772d49997", "value": "112bdbe7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b52db35-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460894, "uuid": "08cacc5b-f845-4b48-bb34-b8f38304604e", "comment": "Malware payload (Dridex)", "value": "964a72b89977b72d02fa47494a7d0134", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460894, "uuid": "4274b994-b8fb-4ea7-a3ca-53527f3de092", "comment": "Malware payload (Dridex)", "value": "cdc981fa6bb3d53f4f92c4310a608f37a8fb4b2f276f7c033b56ccf3180bca49", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460894, "uuid": "610afb1e-0874-42f2-89c1-6b8759216530", "comment": "Malware payload (Dridex)", "value": "088cddb2db341d754a30f6b6564afa376ef34648", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460894, "uuid": "3940e17f-c497-4e7b-b8b6-eddef56014ae", "comment": "Malware payload (Dridex)", "value": "9f485cba75e14ef540db28cf35e99323cf97451049c76c6d58a39e944dbe5f8d4e2a3244939041c1f89762bf216d1c20", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460894, "uuid": "ec4b13a3-83bb-44dd-8412-ad8d0bf53990", "value": "F6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460894, "uuid": "976799b8-c847-47c0-93e4-bbaadce735b0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460894, "uuid": "4d3c9414-ed84-40a7-b8c3-c0073007285a", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460894, "uuid": "b7ffa50d-4a62-4b51-b44d-72543e33946d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460894, "uuid": "00c7e124-c835-4052-8f89-c19547b9dfde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460894, "uuid": "abccecf3-231d-4be2-a626-7c112ab304fe", "value": "964a72b8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7008c600-affe-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620479290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479290, "uuid": "e09817f3-b06b-47a7-9dfd-57f086ae5440", "comment": "Malware payload (AgentTesla)", "value": "280a29ea8ad6da5302a8305b1fb4cadb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479290, "uuid": "a9d32ae8-8cde-4aae-af22-05b7477c7343", "comment": "Malware payload (AgentTesla)", "value": "cf64d0899faa94e1f65141f031fd5b34a18aa0e3c490f258aa85722edf658edc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479290, "uuid": "19dd9de6-1170-49ed-94d5-98dfe5441e7c", "comment": "Malware payload (AgentTesla)", "value": "0740d9445cf79ea0029b7cd7b6fb76578aedf084", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479290, "uuid": "62903d93-75b2-4820-b5f7-5be05c1e408d", "comment": "Malware payload (AgentTesla)", "value": "1927fd5d65e86de01c6e0be9a9e6552e809e0515a8f8d1b03fddc554c94ae7a8bec6e5cc9e870f6ddb97833ef9b1cb4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479290, "uuid": "bf704c5e-4a5e-4e4a-94ad-d72806fe417c", "value": "8FF4E0222381EA14E82A9B75D06067F027F1BC02F762DE0FADD47D9D7976AD243952C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479290, "uuid": "cc02079b-16d6-446e-84f0-67ee70f0bd82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479290, "uuid": "360fb30c-822c-4632-91e1-f1e9e0ffdf48", "value": "12288:TpKnXMsddnFm8e4y/QspiAmVnRxUoirVonSwtkLesY0uHb7FAg4M7pS:TpYDd9Fm8dfAAnRxUx2SwLsob7T7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620479290, "uuid": "7bfb23b9-57c6-400d-bc19-a9260bb73794", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620479290, "uuid": "44fa17d5-049a-4e0d-b891-6cec64d0d788", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479290, "uuid": "854c50df-f708-4819-94e7-abf88dc3b69b", "value": "wX1ewudNGjB0iNi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f3204e-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442905, "uuid": "511aae15-08a0-4684-a5ff-a85de3a23fca", "comment": "Malware payload (Dridex)", "value": "5eb0b0d322ce4a6f176e0b095679ae20", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442905, "uuid": "36d67de8-6bf2-4743-a7e8-5886d6ccd641", "comment": "Malware payload (Dridex)", "value": "cf9d231a0440cf94c8528b2c547ec470a99f767bda4ec445149ee1221cc2d59b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442905, "uuid": "562e322e-e9b2-488a-aba2-c1dd9bb6c040", "comment": "Malware payload (Dridex)", "value": "8060660e71a7f8810810ca8caa519cfd271f5fac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442905, "uuid": "0fde9890-9daf-4456-b4b5-8d791fa62e77", "comment": "Malware payload (Dridex)", "value": "60f387e91c8aca81380b5f2f4fdd70659eec4f7fb6a9166eca48338f0f34eb1b9e7f9b2e7f1ce24236fc1617974f1b0d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442905, "uuid": "2881b276-e533-4042-9687-eda59513dd00", "value": "7DF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442905, "uuid": "21d07c64-b988-45cc-8ef0-8a41d1cfbf3c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442905, "uuid": "2e1e6687-c620-40b1-8582-0c1631b1c7e5", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442905, "uuid": "6e190486-aeac-4c78-ac35-b363180c42c7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442905, "uuid": "83fa2e6b-c9ad-49de-a738-836b4c3f3163", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442905, "uuid": "5a71b6d8-6d56-47b4-8baa-f78cb3fd3236", "value": "5eb0b0d3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf3ebc6-b005-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482507, "uuid": "1d271e61-95f1-4b20-89fc-559a52aa0a18", "comment": "Malware payload (Dridex)", "value": "c85747766b0ffaa04343b8f76fd2cd53", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482507, "uuid": "b73ee033-c38c-465f-9ba9-a4171cc8e3e7", "comment": "Malware payload (Dridex)", "value": "cfa8cd49ec33900a9771d530a7f3f0cdc9738bcee714bd6a7b1546203ad39c7b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482507, "uuid": "456038cb-ebf0-4125-bdde-9387dfd99b30", "comment": "Malware payload (Dridex)", "value": "cd00a53203bd032972bc472896a39ca4668ec8b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482507, "uuid": "fc12372f-d518-49a6-b2a3-ea6259c865c4", "comment": "Malware payload (Dridex)", "value": "97aa21b8c7542f88015302ae9d1ef4c0679de595707ef33fea01a5ce8a744e5031a1d3dde199265fb5823f9308dfc66f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482507, "uuid": "4a931a91-46ee-4a36-aa20-7ee3aa34f1b6", "value": "46F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482507, "uuid": "5e905097-b976-4376-b593-74257c7db87d", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482507, "uuid": "68c607b0-c998-43de-8e63-b271b3c78b75", "value": "3072:WWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:W42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482507, "uuid": "34d80d12-be0f-487d-83df-715a9dcf378c", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482507, "uuid": "6c5b2f6e-10c3-43e8-9549-cbf1a510e545", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482507, "uuid": "def8c76c-07cb-4bf5-848e-d37e9a912b9a", "value": "c8574776_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1efa9b53-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475288, "uuid": "47689415-3330-4eff-b114-0403993331d6", "comment": "Malware payload (Dridex)", "value": "c8089a838a5203bfc69a4ee929d0f288", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475288, "uuid": "84323f42-faf8-401e-aa85-5057b4b2e6d4", "comment": "Malware payload (Dridex)", "value": "cfc4918284e6a73393f987fb0ea9b99c70a684c29cd75ff45f72e258767ac3f2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475288, "uuid": "5be9333b-3c4d-4ebd-a8ab-b091b20c41b2", "comment": "Malware payload (Dridex)", "value": "e92d930e9d71e42fb7ff0553f44de570ea212c12", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475288, "uuid": "5b43461b-d56b-4aca-aeaf-ab51ade95393", "comment": "Malware payload (Dridex)", "value": "78aac371843154b6b8df448af32d00e60d13c6763ef8fae2957e7577bd93633ce91b5b392ccbca1710240f23b8c03e3d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475288, "uuid": "edcd3d0b-971d-4c99-acd1-02120b714af6", "value": "F4F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475288, "uuid": "f2fa0c42-b991-4466-9d62-ccdb9f8500f0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475288, "uuid": "0012df5a-d128-4379-be8c-079c0ca1ef25", "value": "3072:AIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Zc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475288, "uuid": "d51f6875-01bd-48f4-bc06-0141336e511c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475288, "uuid": "3c379e80-2c38-42e4-bc99-360c2fe69c86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475288, "uuid": "f2b2f9e4-264b-47a1-9827-3bf7dc86b76c", "value": "c8089a83_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5dd3d6-afc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620456302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456302, "uuid": "fb37d360-a38b-4045-9d3a-67d170c8dd04", "comment": "Malware payload (AgentTesla)", "value": "a50d337850d27ffe64708723860fe50c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456302, "uuid": "9ae4dfc3-2832-4f40-a94e-0a1c7815cec6", "comment": "Malware payload (AgentTesla)", "value": "cfec10b055bd9acee6ae2f9aa13cb93f3218e046b8808843c5ecf4875fb73d36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456302, "uuid": "bed8450f-a0fe-4093-b198-c34584d5a5a8", "comment": "Malware payload (AgentTesla)", "value": "8925a981df8edcc655d6d519279080ef4f10d8ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456302, "uuid": "d813a713-721e-43a0-9a5e-fbea9e3cfa03", "comment": "Malware payload (AgentTesla)", "value": "441e5f3788bb4aa73e528350029b0267fa4de3a6af3356c8673c9ca9bc56916e186d357d7786b4171ccac86c880cfc25", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456302, "uuid": "5b012aeb-eedb-4919-aa39-e0533ce19bb2", "value": "301527802A66A19DD0703ABDE53134E003B8EE27F9E54DD7429C7B22FDFB8551FA1921", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456302, "uuid": "2f22ada3-3e29-42e7-80fe-29fc098ceb55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456302, "uuid": "0a95aaf0-cb79-4106-9847-c4ef79eb7bab", "value": "12288:+KKxeayECYZ7KVSSidgGIFmMot1MyBjuIQepdheac:tIeaD7KVSSiuFRorMsAenheac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456302, "uuid": "5ba4a68c-70c2-469d-a446-38051cd70264", "value": 932864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456302, "uuid": "44adc30c-0173-4493-aa89-7a02938dcf24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456302, "uuid": "a8e5d8f9-89f7-432e-a54f-650fb4f79fb3", "value": "Bank ReportRef 0180066743.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb11ccf-afc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620456064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456064, "uuid": "09663f7f-07ce-4577-80f5-43f9a9f67a96", "comment": "Malware payload (AgentTesla)", "value": "fcafa74ae13a4ecd5339583e062c64c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456064, "uuid": "874d8db1-8e1a-41dc-87ea-2fa17fe92ea0", "comment": "Malware payload (AgentTesla)", "value": "d0334fd95e2c904990cb4f38f2b1583979c56b8c07cdbd9a82bd111bdd0cfeb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456064, "uuid": "0779d3c4-5032-4612-a732-2b0a581690ea", "comment": "Malware payload (AgentTesla)", "value": "d07be187ba8166fdaba6ae74e2fa0d240091706a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456064, "uuid": "d43e4588-1fd0-40d7-ac68-6e2f3156493e", "comment": "Malware payload (AgentTesla)", "value": "6287fcacc4fbb8546d4c1c19641dadb3b40a11a1de52a33dd9f23d4c65bd0e9b6550c0198ef8e4d4d2b1fe9c4623b6da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456064, "uuid": "7045579a-063c-4179-9625-2f3c6131ed31", "value": "F1F47DFC755465F0E35B5D23A3CF0C0642252274A93BAA1E8B6013BE1A67E173E39D8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456064, "uuid": "d6f1c935-83fb-4a7e-9a1e-6688a078f124", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456064, "uuid": "2253fc54-55f2-4a35-a5ab-5bcb08340393", "value": "12288:kNH1oLLoS60/K7yh0HIHlO/T9Z3XpWgAXDYe5wKiSQO+XQM5kO1VrFVqi+Evu:81oLAoyvcJiKcO+XF5kO1JFhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456064, "uuid": "f8e8299f-931d-48de-aac8-f4ee9bc3ae99", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456064, "uuid": "c43bc2dc-2bbf-4d44-972d-137ad2ce8047", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456064, "uuid": "beec42e6-5b63-473a-891a-a312b579ef04", "value": "Invoice 2105011348.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3f5754-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468063, "uuid": "ea842626-5413-4fe6-90c1-b870ed9646fd", "comment": "Malware payload (Dridex)", "value": "bb0cec10a308524f1431825536df3bdc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468063, "uuid": "436de751-2f7a-4908-979f-53e966760e8a", "comment": "Malware payload (Dridex)", "value": "d0395bbdf2b67de79fc065c764b4818a2ea9c3955a80806e323dfb68c633bb97", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468063, "uuid": "a82627ba-dd98-47a7-b78e-ad514da7a6c5", "comment": "Malware payload (Dridex)", "value": "a5731f498d9ca1a6aa119ef3ab4cdd2f81ed95db", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468063, "uuid": "d892e912-80bf-499d-b361-29f469e74361", "comment": "Malware payload (Dridex)", "value": "e4f4e73b392bcf42ba58100c02e2f8c9c54f72dcb86ec3073ef32d614a82c0a3b5685e3681ee977f7ce7222820659329", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468063, "uuid": "a284a136-c9f2-4be7-9afb-3bca8445b6a7", "value": "D1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468063, "uuid": "763d3b99-99ee-4685-b426-6fcba2264bd3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468063, "uuid": "9a05a1ff-284f-47e5-b89b-e44b741c6835", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468063, "uuid": "6f3cd749-e4b0-4870-8e1d-a2eae0e7363b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468063, "uuid": "9eca004f-3dc4-456e-aaff-e9b25da310a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468063, "uuid": "23d1e80d-987c-4952-9a26-39cf9d94e074", "value": "bb0cec10_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d019c4-b040-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620507748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507748, "uuid": "339f72bf-e111-4c65-bd93-b7bc7fc5fdb2", "comment": "Malware payload", "value": "6031103774d278069f9e6b81e28bde4f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507748, "uuid": "dae256ee-7b65-45d6-b373-78ed1edbb691", "comment": "Malware payload", "value": "d0749a844b5a2ec92b8995170af13b76bcb71021520166ac73cd788937dff04c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507748, "uuid": "a47c1916-2c24-4d45-b0da-448d7e2ae73a", "comment": "Malware payload", "value": "ca6ecd2b10e46f74bef950d1f404b37c8dfb5ee1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507748, "uuid": "55a5f2b3-b02b-42ff-811e-a899ed02f0a5", "comment": "Malware payload", "value": "6b9a30abddf71f5491b72976e2a6fe1d3dc3e030a002b34ed803c8552d4f5c8c66eb6e67948a6e2aa45141a600e02112", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507748, "uuid": "b9dd021f-14f6-44c5-8022-07421e4aebd3", "value": "D5F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507748, "uuid": "b18a6805-bb1d-4af7-97a5-dba509a831c9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507748, "uuid": "14a2f7ce-04c0-4b8d-81ee-073513596d66", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620507748, "uuid": "8b6edfe3-4b2a-4794-b37f-2850a23da882", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620507748, "uuid": "fe3ccebd-cbbe-4bf4-be04-a0aa4b821fd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507748, "uuid": "1a0bb3a6-3fbc-4280-9904-90c1223a29c3", "value": "60311037_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "215fb370-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457253, "uuid": "a4d974b2-2491-4ad0-8c8f-283ee156f842", "comment": "Malware payload (Dridex)", "value": "44b37eaf04c808020554c434f5fcddcf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457253, "uuid": "6c61152b-a766-4014-8a2d-21f8c7e1848b", "comment": "Malware payload (Dridex)", "value": "d0fece95dd5fca6e68d802ec7b501d8de74d64fb38eed30a5b7937cac3ebf82b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457253, "uuid": "5e6ad188-88a9-4559-be8d-f5d18e16fec3", "comment": "Malware payload (Dridex)", "value": "9d76cf7dd6e91292ddce0f7e8db39e505eefd9a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457253, "uuid": "ef6fca94-6819-4c57-ba4c-3f9195bb5070", "comment": "Malware payload (Dridex)", "value": "e0bc9c819caccea459284d852bef637b93dbeb50554ee55646fe262177abc42d39fb986b7090f85717e64d28bb866bfd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457253, "uuid": "aaa7b3c5-6586-4572-bfe4-923c23c288e8", "value": "43F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457253, "uuid": "d69154f8-0e2a-4387-9be8-d0d96dc9c502", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457253, "uuid": "696794aa-8dc5-436d-b6d5-2e123ae209de", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457253, "uuid": "6ec6fe00-8070-4103-97f1-3ebcc874b47e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457253, "uuid": "f5beb181-74ac-410b-9f7e-e32efa42db92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457253, "uuid": "e252105c-6383-4ba8-86e2-676f60172d25", "value": "44b37eaf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8944abad-b027-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620496941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496941, "uuid": "d9bcdaf4-df15-496b-aab4-6aa68c6e0003", "comment": "Malware payload", "value": "eaa997a34f96d004dd06192349dadff2", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496941, "uuid": "72301dec-e343-40e7-90ff-abc8b4c4daba", "comment": "Malware payload", "value": "d1515963649ab80df646b8b742f6be81daae4fae4a356f634c31431f5456f3b7", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496941, "uuid": "4f643fe0-6b74-42da-911f-16ea7bd8b9d1", "comment": "Malware payload", "value": "e1c908aa3004e8ea9e56f2e02c83ca49064abf67", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620496941, "uuid": "c67633f5-13fb-4d1a-b1f9-cdf1de47131e", "comment": "Malware payload", "value": "d4cf9eb8e2babef714fda099312f6723a69e216ef66a41a1da661791fcd4eb680cb33ff1dc1c7997810aa13ed532e3d1", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496941, "uuid": "a01f23e4-f83e-4a8b-9e8e-627926be0116", "value": "4683F129D4BFEC33CC9E4734D22D0F1728AB1ADBD9C1E232F650605E2B84E4D8AD9552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496941, "uuid": "ec15b283-a0fb-430d-932a-d63a5af233c4", "value": "1536:KWRnrjQr2XpbriqdnxlEZL4C+PvC8PCz5IuR2ZH7DuVrBJb5KxcR:LnQr2XpSInwz8Ez5IuK7DuVQxcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620496941, "uuid": "18fc7f11-8119-412f-b4b3-2dcbeb4884fd", "value": 88763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620496941, "uuid": "fc7ee3d3-106a-4628-809d-5358dee722f1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620496941, "uuid": "d92d1a00-6afe-41b6-a248-b5cca3c4188b", "value": "export of invoice 226740.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e7e566-afa1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620439252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439252, "uuid": "2e5c5bb2-023c-4bf4-a204-4dcebdc0a402", "comment": "Malware payload (Dridex)", "value": "d9eef3587c7cda6175cf80f56fbb5459", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439252, "uuid": "898f1797-d8c3-4e4a-a264-2bdbb68aae1b", "comment": "Malware payload (Dridex)", "value": "d1c4367a7da827b7ee3e835d694b71dc83bd37d2c0254682fc9d9dada333f66d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439252, "uuid": "8781fde6-8d08-4900-97ff-73ece66ab824", "comment": "Malware payload (Dridex)", "value": "61d57421517599aaea2780a73a9e80e2baf12e8e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439252, "uuid": "72276ec0-a667-46fa-92ed-14cc79d34c7b", "comment": "Malware payload (Dridex)", "value": "b5eba4cc66071d28716847bbf02460bc11312443db87f67ab3161f575d2f6e7848c7259add292a3e512c135e0ba62a11", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439252, "uuid": "6b8c60fd-05e8-4bb8-8f9c-4283b7348363", "value": "6DF3D081E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439252, "uuid": "2e11b1b3-bdc5-476f-aa33-ab1694297d14", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439252, "uuid": "81c66a6f-cc19-41bd-a8bf-037fc8140cdd", "value": "3072:5BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eH2H:nuXLcclWEc2HeSjNjGdeWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620439252, "uuid": "f26011c0-1ba2-424f-a442-d0e0bd899170", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620439252, "uuid": "fdeccb3a-b1b0-44ba-a81c-f299a2b8db84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439252, "uuid": "399e1fc2-b4b3-415a-991d-1eeb7de20f76", "value": "d9eef358_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a235154-afa1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620439256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439256, "uuid": "fc0223ef-79c5-426a-be66-5d3f036caae3", "comment": "Malware payload (Dridex)", "value": "7af510d69817f767d9930a9f3a70c406", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439256, "uuid": "37934550-7e1b-4f5b-a0fe-ce3a2b20b57b", "comment": "Malware payload (Dridex)", "value": "d1e3ef683ecb92c25b28e0aed0858c39ff05b64d030ec820f2975255e3fae5be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439256, "uuid": "94516619-6779-4792-a457-d54f3546eaa1", "comment": "Malware payload (Dridex)", "value": "d2a4e835794685d4a22e8b3af88bb6282141e399", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439256, "uuid": "37922941-5450-4e0f-a01f-bb177de04b4f", "comment": "Malware payload (Dridex)", "value": "bd99d5172a978b8573125f98570f610cdfdc89a4303834b74cf064c057a1cbaecf91fa13a246020926f4eb703b263a02", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439256, "uuid": "ea3da643-bd7c-47a4-b26b-551505572623", "value": "52F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439256, "uuid": "f2e16ce9-9c8c-455a-b4a0-bc05016a3ee1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439256, "uuid": "9dd6b955-0bde-46ef-98cf-8a05299ab4fe", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620439256, "uuid": "3bf6fd96-24b2-4682-bc92-3036e3092866", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620439256, "uuid": "a6159af4-8972-4423-a4f4-841206375835", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439256, "uuid": "a5e3d833-ae93-4c4b-9f63-6b3db9dda46f", "value": "7af510d6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72323c0d-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432049, "uuid": "ddf6e14b-a3c4-4314-bb6c-dd5c3b1bb17f", "comment": "Malware payload (Dridex)", "value": "307472c91c905f081f9608643ab5a768", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432049, "uuid": "1720bdf2-e2a8-4611-8bb8-1ba011fe96a5", "comment": "Malware payload (Dridex)", "value": "d27f9152449b4fc5f6133c19cc4f65d012ec883ff618a37a84e6045e5dad9328", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432049, "uuid": "f9175b4d-5f02-4ee3-a3bb-7d499df972c9", "comment": "Malware payload (Dridex)", "value": "a1114ba97add9fdad316a6bd685efeb09f1e6753", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432049, "uuid": "266d4dae-717a-4697-b68a-2e42e8a0dfbf", "comment": "Malware payload (Dridex)", "value": "12a2900fe9e9444ad5d88c5cb768272d314aa456f3ad7e2878870d6d9e7d55ab706359c47e20cb59c734784deda88b0f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432049, "uuid": "34a312f2-c4f0-4f9d-9607-ab32d19de763", "value": "C7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432049, "uuid": "f932b54f-6133-41e0-b59a-de0320d491e4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432049, "uuid": "2984e2a9-88f2-481a-850e-8696b78cea8f", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432049, "uuid": "0c8a6c22-8d13-415d-9165-9462920c9ffa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432049, "uuid": "963ad5ef-c45b-45e9-8dbd-c3ce71956b2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432049, "uuid": "0728a524-8863-447a-a4a4-32897172e8d9", "value": "307472c9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5288bbf7-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468073, "uuid": "1e7140ad-4cde-42d3-9b8f-d1f4cb6390b6", "comment": "Malware payload (Dridex)", "value": "82c230daf3059262ff6a00367cf57857", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468073, "uuid": "f04fa8ec-e06b-4475-8f62-636c556369c3", "comment": "Malware payload (Dridex)", "value": "d3e70dc1c8f565e57f73ebc37b67ba1ed6404d8bf5a72304c9c75824b3994b2c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468073, "uuid": "06b92dc5-87ce-4af6-b359-6c242389e6bf", "comment": "Malware payload (Dridex)", "value": "36ebc804bbb45e23b4880684f7cb104659416d9d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468073, "uuid": "5f5baf6a-ef68-4dce-ba9e-9b14c939671d", "comment": "Malware payload (Dridex)", "value": "d94b50eb41dd63dada97e7ed383e8248027c05764cd2cdbe642f4dc155a3f0545c28f71552fe3ff0b2d0cfadd6511c6b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468073, "uuid": "4aa56359-b5bb-48b5-8073-dd7c97f88f46", "value": "C6F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468073, "uuid": "123d080d-e7d5-4ae2-9fbc-e47ba3269727", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468073, "uuid": "0b9cabf2-6d3d-4e38-b511-00a137970d01", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468073, "uuid": "7a942546-6466-4cb1-b469-4ffb4426a015", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468073, "uuid": "cae11b63-efb8-435a-bfd6-06af800fa398", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468073, "uuid": "20dfbd6f-2fae-4a95-88c7-f1c9e2d45fb1", "value": "82c230da_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271c2852-afbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner)", "timestamp": 1620451250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451250, "uuid": "e6035eca-52fb-4efe-893b-b94269e2ed08", "comment": "Malware payload (CoinMiner)", "value": "3a5e0e0daa9e5b33d1a4d1d3f2dcc8c2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451250, "uuid": "ab23cfca-c28f-4cda-8b2e-01cb7c56bd9a", "comment": "Malware payload (CoinMiner)", "value": "d54d1d90523e7b2d3f5e2b5fe604d5626079b0f53f705321f8ce9644ee4ea3fa", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451250, "uuid": "78dd715e-c182-4d13-8676-176ca40382cb", "comment": "Malware payload (CoinMiner)", "value": "b6239a7b94cc854ee70936866fda324c413e6b15", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451250, "uuid": "ebdaf54b-fd80-4750-83be-298b6c165ee9", "comment": "Malware payload (CoinMiner)", "value": "213a0caf46966aa66ed2005d6d0969717ca53da253d8d500f99be01250e764b84758a20cda8bfef110635fb7c51248c2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451250, "uuid": "738b7fdc-bca7-4cbd-8b92-7b60fee3f0c5", "value": "D51533C112D25DCDC39DA7BB2016A7BACE8A685898EDDF5D76FCB07570F0181B088276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451250, "uuid": "e438b8f4-72d8-425a-8b83-d1535da962c1", "value": "563557d99523e4b1f8aab2eb9b79285e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451250, "uuid": "8e44c796-334a-4b4e-b28d-f666379d9ac0", "value": "12288:Ilek7VIjqS/AttnfMznf81aW56jmi4EAEKw46Ye/WOw6iuex082+ueN3R2q/7lqt:SfKE8WHEm6Yjjduex082+VNh1lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620451250, "uuid": "7a539b62-a25e-46c6-b706-fa88de282559", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620451250, "uuid": "3ab78ac6-e67f-4020-9533-4683c2dfad38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451250, "uuid": "deab06fd-ed32-4cc6-8475-09ba304d8edc", "value": "cpu64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3a578c-afb1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446454, "uuid": "41bdaf40-dbc7-4272-88ff-d7c62b43b6f1", "comment": "Malware payload (Dridex)", "value": "e9115ec8916538821cb2a5c38c328f99", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446454, "uuid": "6976dec7-184d-4068-9b97-31b67fd1e745", "comment": "Malware payload (Dridex)", "value": "d75dcfdcdfb51010631642e13b4041336f8ea26eae890340427ebe79c30e7989", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446454, "uuid": "0039ea83-3dff-4f92-abbf-4fe0865b93f6", "comment": "Malware payload (Dridex)", "value": "492e687de9cfd71488cbe416494d7275f9238728", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446454, "uuid": "165decc6-6cfe-4039-af34-18b7ea931a20", "comment": "Malware payload (Dridex)", "value": "ed28e03b4e204deb6e1f9877636a6219c4e74df698959d87e1486bc88765c1e6a0946eeb626b25a41c2113abafccfcdd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446454, "uuid": "6bb0e7a2-4fea-4c6a-b975-c69bb13b4cc6", "value": "16F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446454, "uuid": "b006f6ff-9dde-4231-b0cd-d55c1a2e4570", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446454, "uuid": "80fceae9-60ca-4c52-8b8c-112e5236e21e", "value": "3072:0lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:0lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446454, "uuid": "2e501bc5-cd87-4e7d-b738-0adcf90fbd71", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446454, "uuid": "1e5d7832-80c5-4df2-ba62-d386ee87dee0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446454, "uuid": "9872a91f-fa11-4ce9-bde8-6f630c579cb9", "value": "e9115ec8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b103f0b-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432090, "uuid": "bbfbad6d-a336-483c-8e6c-adb3caa99127", "comment": "Malware payload (Dridex)", "value": "287e60e5bf365714d2afd659edfe3334", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432090, "uuid": "77b3dffa-f419-4e34-8372-febd663c6bfb", "comment": "Malware payload (Dridex)", "value": "d780cb0dd3160e961a5b13218554976fbd573fd4d60318098ffb0f62b12ba2f6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432090, "uuid": "a6db3289-6d05-4553-b4c6-058593502025", "comment": "Malware payload (Dridex)", "value": "f99fa9d7ccbaea7a874a82a0bcd187634a407cc0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432090, "uuid": "13fd1b11-29be-443b-b18e-1d8dfc945cf1", "comment": "Malware payload (Dridex)", "value": "94401055d9194be18c8602930170b96a975cf63ac5d106c7ba1a9953320bb81c3a3c2e2dd1d7545866ff03d4aec551ad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432090, "uuid": "96682f29-08c3-423d-8227-ba05f5d785fd", "value": "6FF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432090, "uuid": "9cb1663a-8ef9-4ef0-9286-1b1664d353f4", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432090, "uuid": "ad6619a1-75c1-4e71-b83e-20387a5e1288", "value": "3072:6lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:6lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432090, "uuid": "ed61dabe-7189-4116-9a7e-92f5b139c991", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432090, "uuid": "12c55b49-79b4-4546-a958-a4d3bece4a49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432090, "uuid": "df09c1d7-37f0-4829-af9a-705603fc8e37", "value": "287e60e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07ceb65-afc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620456259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456259, "uuid": "a8725ba7-2c5c-4fae-b966-f92c238d0c92", "comment": "Malware payload (AgentTesla)", "value": "2e9ebe27f1f10255e9b1b85125fc3cd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456259, "uuid": "bc067ebd-21c4-483d-b716-d1ed47266fb4", "comment": "Malware payload (AgentTesla)", "value": "d7b03d72883e63c331726ba21acc475c10c90b1a0ab895fbab8f1bf4eb4831cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456259, "uuid": "57b31808-346e-418e-a3f5-e0fba60e8ea5", "comment": "Malware payload (AgentTesla)", "value": "e9f396bfdee9e961298786c8095afdd9eee469a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456259, "uuid": "d4b89b15-9b37-4d9b-ac57-fc7e976b03f5", "comment": "Malware payload (AgentTesla)", "value": "68b1e39eba9fcf4b257dd82234f85bc913a5c6dec5e68b1c2547d709042ec6cad850f7a706c0eb4e343a498ae21cc872", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456259, "uuid": "d9b4fa01-8123-4192-9158-5d79fb362dec", "value": "E4F4126523A89F24C6AF47BA10B1C24857F4F211AB93D31FAED465FE5EA3BC44906703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456259, "uuid": "006518f2-1c4b-417e-8248-563b35790019", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456259, "uuid": "43903f9d-fab1-4bc7-be40-336d39e7af2e", "value": "12288:v0NABx/mCmZerXO+YHx+00pDu/axi2aatPZbYh3aOi9DNFAMAZm:v1BbmoXO+YZSpxVDBb4qOizFA7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456259, "uuid": "a42b1df2-1595-4bee-911e-bee582763d9c", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456259, "uuid": "e64f89ea-79e6-4219-b264-30992b1d86cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456259, "uuid": "2517207d-19a5-47b0-915a-fec3486fb1ec", "value": "Outstanding Usd 738,839.00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b422d027-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442897, "uuid": "3291910f-0be0-4ed8-b56a-b1fc19f9faf6", "comment": "Malware payload (Dridex)", "value": "059e37771701808699615bee692b6065", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442897, "uuid": "842a8b16-d35d-4955-8406-c67edb0f509b", "comment": "Malware payload (Dridex)", "value": "d7e07111dd3cb45a5fa9bffc26f1a9f3bcaa5abcc1ae85c0991e65dae57731fe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442897, "uuid": "ae90256b-a227-4749-a74f-a0ed58c7c53e", "comment": "Malware payload (Dridex)", "value": "8a30f3ab0d85be37db1b999f59651eaf8aa59f54", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442897, "uuid": "3298fb47-1b17-4510-a086-95ddb194ec27", "comment": "Malware payload (Dridex)", "value": "5aea8235e434d3d82256ad8622a5937cc4c5f1c24fd2e21f37c93b38c7ed9c4f8b51322439938836ed37381b805a3e70", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442897, "uuid": "2b68cc49-dcd5-4f15-86ac-991131ac6dda", "value": "CCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442897, "uuid": "c759eb5c-b954-4afd-89a6-99b623d3aa9e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442897, "uuid": "54652dca-6b5e-4a44-b592-8b31810562f8", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442897, "uuid": "71c6702d-edf9-4871-b4d8-be674d180bd6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442897, "uuid": "6ad15228-4b31-4555-a266-afb4c41bca4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442897, "uuid": "8dc286fc-8d80-4f0f-9fcb-dce919ba416d", "value": "059e3777_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6174a376-afe9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620470246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620470246, "uuid": "d62ec13f-40e2-4aee-91f6-a97fcac7844c", "comment": "Malware payload", "value": "fbf2609b1b40cf3ffc7b9348f13768b9", "object_relation": "md5", "Tag": [ { "name": "encrypted", "colour": "#F5A925", "exportable": true, "hide_tag": false }, { "name": "encrypted!", "colour": "#B484FD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620470246, "uuid": "13b69c0e-423b-4512-aaf6-ec2f16e70d4c", "comment": "Malware payload", "value": "d90f026b93b6c51ba23dccf89331db0eedadb3da06492a6fa4bb220d8ca9a1b3", "object_relation": "sha256", "Tag": [ { "name": "encrypted", "colour": "#F5A925", "exportable": true, "hide_tag": false }, { "name": "encrypted!", "colour": "#B484FD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620470246, "uuid": "fead4e42-825a-4f26-892d-3848954857e3", "comment": "Malware payload", "value": "2597d3dd443a9d06fbc8d8aa21e08f74db0c2b1a", "object_relation": "sha1", "Tag": [ { "name": "encrypted", "colour": "#F5A925", "exportable": true, "hide_tag": false }, { "name": "encrypted!", "colour": "#B484FD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620470246, "uuid": "b695deb4-478f-4d90-84fd-3d97473a8bd8", "comment": "Malware payload", "value": "a30f18c46fc478b081dfd85d49bef36a4e3e2cc6571651dc3e330a2160025f0a0011e762b62e618e73dba39cd4cb6dfc", "object_relation": "sha3-384", "Tag": [ { "name": "encrypted", "colour": "#F5A925", "exportable": true, "hide_tag": false }, { "name": "encrypted!", "colour": "#B484FD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620470246, "uuid": "bc2d611e-d46b-4207-9d9d-9bdc1db9ac86", "value": "CF838D22B691C032C06616704C68C7B16A7FF9329678C9877B991B7E9F702C06E79367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620470246, "uuid": "2540c067-4c18-4231-810c-082b15b2edde", "value": "b3c3e70ee9d7e93cf06e42cc59bcb319", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620470246, "uuid": "98850574-4c41-4fa2-b533-a458377fab21", "value": "1536:a3tX50V8UalWKzUmazIWdhxUqLbKaPS+3p39Z/0ljpoR:a3tJnUadKTdTA7+3p39Z/0noR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620470246, "uuid": "c0511c4a-759c-4afc-859b-7f078d86abf1", "value": 80946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620470246, "uuid": "df547efd-bbe4-4035-b3e2-c86030c3afce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620470246, "uuid": "fe1001f5-8a5a-4ab4-af2c-87f20eba2411", "value": "r1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2bb46c-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432037, "uuid": "b9d99dbc-6f95-486a-83bc-476ccf948e1b", "comment": "Malware payload (Dridex)", "value": "47171c290179849eec5f248468cc8ff0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432037, "uuid": "9d8475fd-6265-41a0-9bc3-5fb51b31da65", "comment": "Malware payload (Dridex)", "value": "d93a899b888c6e875ee1d0da44f66809ff2935134928559ff4d2218dfb74a132", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432037, "uuid": "e207852d-f4a1-485a-9ed5-bf60b18d0a1f", "comment": "Malware payload (Dridex)", "value": "71e95d0b0690c61a64863f7be6ac2bdd946ff838", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432037, "uuid": "cc534da1-b434-47b4-b707-2f8685f0b068", "comment": "Malware payload (Dridex)", "value": "66468b1375d70f1053b0e4d0bf7c27c9254ed811153ccc99ca8b7b816443306a12837a5f2427b3764a20733e3f31b1f4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432037, "uuid": "4c851cdb-1a73-4b70-8c0e-e3f5ddf2ac8e", "value": "3EF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432037, "uuid": "099dc4d7-d70f-44d3-b437-25e57730a93b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432037, "uuid": "9c742e9d-c61d-44e3-85d0-58e28524cdaa", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432037, "uuid": "4f7455a7-7d3a-4528-ac9c-e5404b5d2840", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432037, "uuid": "2a93fdee-d0e3-4d89-97c6-35d9b280a114", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432037, "uuid": "a98c5500-d801-4792-806c-b5325f7eb37b", "value": "47171c29_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48873688-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457319, "uuid": "e2218695-bc06-444d-88ba-fd01da394c14", "comment": "Malware payload (Dridex)", "value": "85dfb51d7ae730c320f8ce21b5c126d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457319, "uuid": "da92b628-5b93-4965-9cd2-886b406f6298", "comment": "Malware payload (Dridex)", "value": "d93cd5e7aa2f1843f97281212e4fcf89664bfed16843095ee598b4a4fa7a5180", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457319, "uuid": "a5df3b99-2340-4221-884e-e185f56c7034", "comment": "Malware payload (Dridex)", "value": "49b6bc6be3b4b64ff468ea2f52437200fb627d36", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457319, "uuid": "3d6a8cba-ef3f-4ab7-b5d9-27891b492a1a", "comment": "Malware payload (Dridex)", "value": "952f2162ceb6197a246601f7df4582f151e3256ee64e41abe55478d5d1169c1710b44c1914f24421441377dbb71a1da6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457319, "uuid": "73103b18-a57e-4e11-8871-3e8a44bc81ae", "value": "3AF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457319, "uuid": "9a87f971-d84e-40b0-a34d-417a21108eef", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457319, "uuid": "5e33bf07-60ed-4564-9b92-ddff7c97e6dc", "value": "3072:uiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:leAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457319, "uuid": "c79c836d-841f-46eb-b053-32dcae438503", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457319, "uuid": "b5659592-0677-4677-8698-9a538f92162a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457319, "uuid": "04947274-81c5-4be9-be5f-161d36732bb3", "value": "85dfb51d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5567736e-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620475379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "ae0f4ebe-b0d3-4868-a8ce-0badce91e430", "comment": "Malware payload", "value": "617093e70bfacab7f536ef3eb52fe0de", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "c843ae5d-8f41-4077-83c2-38c38d8323f2", "comment": "Malware payload", "value": "d95bdbc811bfbe18023b1e15785a7c3b5ff0f34574300b0bd68a877274d6786c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "5d6d7498-447d-40c2-b719-69207cf861b3", "comment": "Malware payload", "value": "16416458f5c69dcc87b4bc922d716289a3ec8b85", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "dc3e996b-01fa-4aee-aa8f-9f70f6b2b88a", "comment": "Malware payload", "value": "6860a6b6ca8adee4b9bbba0884a9c05a6a6246970b864eae43ac30f00626d19c21536e9ad8900152a6d2b6f66ae80844", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475379, "uuid": "436716db-9f2c-45f6-99b1-b1d188c55718", "value": "2A93B63B7B130E23C0D6107112F30632ACB5DF9B38B94697ACA07D9D5F3A9843556AE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475379, "uuid": "fa60d0d3-68d1-4bfa-98eb-6e1bf8956045", "value": "768:2l8EwCKCGCQlCyONx+vH+rSzytomiTY+Ge5hR2lnDaTmP+t4cO+N95VW+N8qVo+h:DLXbluV51DaagN95pntPGtgQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475379, "uuid": "24510c15-54d4-4b87-ac3f-3d743036bd69", "value": 94680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475379, "uuid": "4ed8a951-1c5b-4360-b40d-f8ea5cf74ce4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475379, "uuid": "908af268-ce2d-448b-a1f0-89193c790c9a", "value": "SPARC(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e031bcd-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471636, "uuid": "0197e585-bec1-455c-b024-544e4bd4b062", "comment": "Malware payload (Dridex)", "value": "7c952880e0a8c431d11740cd46d0b343", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471636, "uuid": "86112a73-ca7e-4ac3-adb5-76d17d0c6b10", "comment": "Malware payload (Dridex)", "value": "d95ebde530422b6d810e7506b46726c4554a90ea44bdaf551b02e7f4d37fd002", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471636, "uuid": "a581b794-8676-418d-8c15-65edf2ffbadb", "comment": "Malware payload (Dridex)", "value": "8e9d61e7ae30bacabe7f3018b2ae46830309c3c2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471636, "uuid": "c1d309db-5a2e-4f73-95d6-b46a466c203e", "comment": "Malware payload (Dridex)", "value": "4849a20292d8ccf495e1f151865e497f439caef1ae533cc1ee9c3ead7441fa95d56972ce5572ad9f88fa211f370049dd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471636, "uuid": "4dc152ce-8d41-43b0-bc1d-39f40f68a59e", "value": "D7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471636, "uuid": "b1cfd99c-8e13-418f-a69d-991f789a2cd0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471636, "uuid": "885015ce-8581-4eba-9ef7-de925a120e18", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471636, "uuid": "eeb92a96-41b0-4b49-94fd-7333a9b704b9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471636, "uuid": "d1022d54-609a-465a-be92-75ed23892285", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471636, "uuid": "c3b6c011-f5cf-40f4-9a1c-4153618b712e", "value": "7c952880_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f1dd8b-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "b6f39923-e353-45ba-91eb-5b53bb9ac69a", "comment": "Malware payload (Mirai)", "value": "3c25c3dc6c92534bcf895185629aa1bd", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "c737b924-c94d-46f4-9fd0-d299bc169194", "comment": "Malware payload (Mirai)", "value": "d9d6252ff55192b8d254557756da91a106c012ca33f7030715a98af085299813", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "861988a7-afa8-4502-ba56-5700c92eb29b", "comment": "Malware payload (Mirai)", "value": "4d2813a6194ef28933f30d6c1f4b1768b4c6ca51", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "3f9891f4-ca1f-4934-8d80-e8034e3e88cc", "comment": "Malware payload (Mirai)", "value": "d0c747b867dc3fe874e2b6071f1f415e70c5b0b1bdf13dbfb5a14753503b1fd47161bde5c7beef2fb4c73893a172e8f5", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475374, "uuid": "aef2c67a-6b4d-4019-af55-53c7a1563c2c", "value": "6F341989FE18AB2FC3D227FAEB5903CE3339865877DA72115C31197437C6B64A627124", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475374, "uuid": "e856cb79-15d9-4dcd-bc45-18253ae32d21", "value": "3072:Bl9RwtZg9Q+27r4bYQLIbOs/bNXW4Y4AqZ28LxOQnBkIrN+jeKVgAZSiOjbr:39RwtZgKl/ZRLQQBkIr4aKVgisXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475374, "uuid": "b116c56b-6dc1-4e3f-94d9-a63679e63cc5", "value": 235695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475374, "uuid": "0177fd22-4d44-4bb5-ab39-bcc789b57e5d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475374, "uuid": "b76774f2-1087-4b8e-bde0-647ead19e7ca", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b8fa9a-b049-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620511505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511505, "uuid": "bf80ca5c-96fb-41c6-91d8-2c766a13688d", "comment": "Malware payload", "value": "9e3f574e1ef7fb379ca40d9d2624fd23", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511505, "uuid": "59f4fc2b-497c-4260-9bd7-ade649b3d95b", "comment": "Malware payload", "value": "da119e0f416a76e97d424fb9c2dd8929181cf67a4f591e77ca3c726ea820990d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511505, "uuid": "cc6b2e71-1e42-456d-8d1d-a35e7586a33c", "comment": "Malware payload", "value": "6fc5f59ede081aafd3b83874a18e4d7b5eab7447", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511505, "uuid": "30d816cf-4991-4c3b-8f9d-4917d55b80dc", "comment": "Malware payload", "value": "4ca06dde22812b390b0eff2e551c3aedb1bb0b646cd02bf52299e48ca6f6dd4274e024825c75968ab702bc8528670242", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511505, "uuid": "feb4124e-6c5c-42d0-9898-7b6a3113642e", "value": "75F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511505, "uuid": "79ad73a3-4ab0-48c2-b156-f2125979c06b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511505, "uuid": "e39d4021-f4c1-45b7-8eb1-1df1c85affe9", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620511505, "uuid": "476a9679-09a1-49ac-8603-dc0cc31cd416", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620511505, "uuid": "4be14f99-1a11-407a-80b9-df3e1e09256b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511505, "uuid": "bb3fb94a-76d2-4fe5-ab1d-1f4b08ea184e", "value": "9e3f574e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f0bbf5-afff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Pony)", "timestamp": 1620479759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479759, "uuid": "3ef14c9b-3c3c-4e82-83df-c21927303299", "comment": "Malware payload (Pony)", "value": "d028ba5c6e2a15322c1cf6cc8c1ac629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479759, "uuid": "d7010a06-39e2-4cc8-ba8a-080c75efea7c", "comment": "Malware payload (Pony)", "value": "db193c62954ba31e002abde594676ddba392dfdb2da8ee8aad14b814dae2a6aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479759, "uuid": "214afcb9-ad6a-44f9-a31a-5762b8b85ef3", "comment": "Malware payload (Pony)", "value": "206a5922c5e402d6d592e378d52be528b1d41c78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479759, "uuid": "866a9b07-5e75-4d9a-9d7b-d13707aa50d7", "comment": "Malware payload (Pony)", "value": "2f7fd048852f9ad4b0e16652437ae3262009dda75a7decdb50d31e6d6c01627c4a66097d032af35d3931f07170fe2fb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479759, "uuid": "3bd8ac7c-5a71-4d4e-a62b-9356f3d0d8c4", "value": "5A53E147BA840963DBF516742A73E975C0BABC300B14AE97FBC59659183A080F81AB5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479759, "uuid": "538f7633-3911-40cb-bf0d-d818b6e98ce1", "value": "0614a9048ff511eb3e43745e72980f61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479759, "uuid": "125623a4-795c-412e-9339-dd990398fa2a", "value": "1536:mNcntwQz4RIz7f0PnDu3anqYwHUynSsd0rrEg:oDIz7f0rI1Hd+rEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620479759, "uuid": "26c796b4-b9df-4f1e-86ab-287aa8203d55", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620479759, "uuid": "d8e13623-379b-4116-befe-01fca8cd1adc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479759, "uuid": "7c9096f4-db9b-4e42-99e7-e7a69ee0237e", "value": "pieceofshit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c9a8d2-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471674, "uuid": "d4cb6cd9-e575-4903-ada7-501a71572b77", "comment": "Malware payload (Dridex)", "value": "d3754ff1fc702abbfc84e68699d6c72c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471674, "uuid": "be7da75b-6691-4f9a-8e59-5eeb269f32a2", "comment": "Malware payload (Dridex)", "value": "dbe02b6379fabb347bd43a0ee4965fcdfa3338cf9818464312b9d18020520a85", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471674, "uuid": "98d86f50-52b3-43f6-b371-73dc107dec04", "comment": "Malware payload (Dridex)", "value": "770db34aafb3d158c781895c7d52bfbd71070eab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471674, "uuid": "19edefc4-0738-485b-ab90-fc30cf949920", "comment": "Malware payload (Dridex)", "value": "a7546bdba40bf75dd20d8d9cd4f8c1f5c5df99f8b5f60379f669366329229a8071bae7e7dfb2025dc0d18ea3ef755219", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471674, "uuid": "11229bc6-433d-469e-a0fa-5d8a12f1c7b4", "value": "A5F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471674, "uuid": "dda70b35-89c7-4b4b-acd6-63f1d4e46e97", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471674, "uuid": "da2b3fdf-fb98-40e1-9d93-fc72abb7859f", "value": "3072:LWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:L42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471674, "uuid": "eb7859a7-eae2-45cc-9a9a-10bce54ea3bf", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471674, "uuid": "390f6fea-482b-47ce-8fd7-e2913b9cba9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471674, "uuid": "6d1b86da-d5bd-4bcf-9bae-1adc40f2908a", "value": "d3754ff1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5793795b-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "44bcfbe8-fe31-4a20-9b96-128b83731177", "comment": "Malware payload (Mirai)", "value": "e78abc1f6a132b13e1e60d716251bf9a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "cb17187e-35b0-4d4f-9271-ce832eb0a694", "comment": "Malware payload (Mirai)", "value": "dbf3ce2740db321fd92faa5b15db172c5f60cf906aeb1dde1a5b0013094341ee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "dfdd70e7-5407-4394-8fb5-56b7d362f9b3", "comment": "Malware payload (Mirai)", "value": "c388c65ef3effc783d9fa528e40798bbbe2deb57", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "be05e231-4817-4900-8a4f-2078ea717a8b", "comment": "Malware payload (Mirai)", "value": "234c7f38f5fbf0a2bc489eabebe8d03966c7f4117f40e31b4359f9ea5fd571b04e928ae84349e4537adfddc85784ff97", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "69363ec0-9551-456e-90f9-05732e473a90", "value": "9D138D76C82DADD4C1548678E865AEB81F63F00496572EF60E8B85959083EFCFB093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "ba24dee0-6986-4cee-88ae-45d2b4b7bd6c", "value": "768:VFaDwIwtUHkuPxX/ieyAe3TVeJo/jFNrYmWCoPiHoLGFCD:VFaMIwtUEoiFAI1js7XiISFCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475383, "uuid": "a8475c46-d59c-4566-97dc-2504fdd69427", "value": 42484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475383, "uuid": "3ebe0c04-0eb5-4d80-ba6e-cce32d80635a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "3cb20568-94d7-43d9-be21-9f44e302e755", "value": "Winbox.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b711c87-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620478933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478933, "uuid": "515d6269-8a61-4b57-9161-3719a9229d37", "comment": "Malware payload", "value": "215d58ed2a40c08df76558d77588e09c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478933, "uuid": "93521056-c54d-4fb1-bd69-097cee50c586", "comment": "Malware payload", "value": "dbf55407956dcd3184bce35b35697a073f5fa51b6fcb7713e9aef81fa9511ec6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478933, "uuid": "4650902f-feec-4a1b-b137-ced8e261243d", "comment": "Malware payload", "value": "5fd586c88f0cb843fc91ca1efcd4e5acec20efb3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478933, "uuid": "ab7d1ce5-6afd-438f-b8ce-5f04b383f3e1", "comment": "Malware payload", "value": "f95c253716526d0641a2fa53d9d39c58ede14afd5f3405659518b135757e157c082e11c6e96b2d97046dd3932df1ec1c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478933, "uuid": "66c0dcb5-7ae6-4ba0-8784-c055bac111c4", "value": "655612239D2590F0C1C5D8F78EFEEDECF1B696764A815C789996A8C0D73B4A1BD03602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478933, "uuid": "380bee2b-9f5b-49b0-9d44-a0977c87904e", "value": "d6c9cce97eb4f66698237605d85ef325", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478933, "uuid": "18ee699f-452f-4ffd-8495-7bd48ab48090", "value": "98304:HLA6+Im3tNOG8Vm+9fM7xeUwRD2BH/Ay09k7CpAbZogEzQxg08Z5qFvr4r:kIm32VmCkipb9iCpgszsgdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478933, "uuid": "ee4aa92b-59f5-482c-9895-1c5061bfe259", "value": 5911552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478933, "uuid": "fa9572cc-60e0-412e-8a3d-3ae597d0b860", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478933, "uuid": "4b6e5fa5-6acc-4191-9d88-9f83760c8d18", "value": "215d58ed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b530fc-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432100, "uuid": "8fee41db-9b6a-451b-813f-d5a3020b6dfa", "comment": "Malware payload (Dridex)", "value": "3f3169288f55a75d638d012808149bd0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432100, "uuid": "8236344d-2408-4dfa-9922-d66acc9d524a", "comment": "Malware payload (Dridex)", "value": "dc17eb6c4dcce9bcc258cab7157bc8ec541a17252949783148993334b1f57487", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432100, "uuid": "e1a1ee16-7195-46df-b069-c37298245202", "comment": "Malware payload (Dridex)", "value": "8b0314de5d49f77915d13ef3471eec1a9a3d2eb0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432100, "uuid": "7908255e-e41d-42bd-9ce4-4d3810505d99", "comment": "Malware payload (Dridex)", "value": "4e212c5c90d0192bfdcabc4c6c14ec790bca477c4501fb53f5086306e38181bf5dee7a56f7aff483302d3434637e4416", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432100, "uuid": "14046c31-31f1-4221-925e-e361ed2734d0", "value": "6CF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432100, "uuid": "737b6dfd-7e71-40af-bb0c-662ae8bf60a8", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432100, "uuid": "ac0a286f-98c3-4652-89f3-28a2723485db", "value": "3072:RWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:R42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432100, "uuid": "f20da896-c05e-4faf-8606-6097507f3630", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432100, "uuid": "b1ec0474-b6bd-4181-b080-3a7794387160", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432100, "uuid": "36a567d5-8b1b-46ab-bc04-666381bf078c", "value": "3f316928_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d46cf3e-afdc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464548, "uuid": "51a230e2-42dd-4844-8e24-4e06f49e00e1", "comment": "Malware payload (Dridex)", "value": "56f354178623b3b74180c82b72f2a853", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464548, "uuid": "7b243a08-a2c6-43f7-920b-dbcbc4a833d3", "comment": "Malware payload (Dridex)", "value": "dc9c4102f55b96643cb6ed71d3fa8c547dc68901ef036e628408756d706c4101", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464548, "uuid": "bb497d3c-2527-4575-b7d2-23c3245cf2b6", "comment": "Malware payload (Dridex)", "value": "2fc70f54fc73671fa3bbfe944e066a300ae39416", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464548, "uuid": "586d2078-49b8-44a5-949b-0972fe7fd068", "comment": "Malware payload (Dridex)", "value": "d836cc200d5d578dd965401395be89815a50cbe37013c503c733446c1e31cf97fce49ac755f59f84490bf61241e84110", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464548, "uuid": "fc264396-6418-4320-9a6e-9dd9e2f1ce94", "value": "F6F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464548, "uuid": "866c15bd-e049-4ac9-859e-8553863bb70e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464548, "uuid": "ea1a9c04-bef4-4a0f-9c8f-7f84a076bb3c", "value": "3072:Jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464548, "uuid": "a28b5421-8a58-4089-b542-6a448d343e85", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464548, "uuid": "8d3680f6-464c-4490-8887-7b1f03836cd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464548, "uuid": "b0bf9dfe-8d7d-4ec9-9aa0-536a3a5fda34", "value": "56f35417_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd454d74-b027-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620497082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497082, "uuid": "6ebadf05-040d-4ee0-94fd-a21de3d755c9", "comment": "Malware payload (Dridex)", "value": "e78d1785cc1f05ec2eb0665902a76e22", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497082, "uuid": "ab2e546d-7ef3-436a-a36a-518bf19f4527", "comment": "Malware payload (Dridex)", "value": "dca529bc6631308c9fa61d0abc61b392c0eca5ca6128a1f11d1a52489bd1e90d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497082, "uuid": "bab6664a-5610-41e9-bfb2-40f57388df23", "comment": "Malware payload (Dridex)", "value": "5611ea6e7f243de7730358f67c897f299b1c5a16", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497082, "uuid": "c0f24eb3-210d-4fbd-8da0-6bb081ec88e4", "comment": "Malware payload (Dridex)", "value": "f1788e2ed833311a32d940147371689537b0051dfd8371e29dbfb8580eb03b1c2caa978abe84660fa3ceb15da88538a3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497082, "uuid": "4158fff7-4aa7-46ba-b7e5-bb4ded6c1194", "value": "ECF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497082, "uuid": "5a71a162-d473-475b-9fe6-badc057a1ae8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497082, "uuid": "bb9f9851-8855-4936-a875-fe23e37b8fe3", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620497082, "uuid": "5867a7a8-5db8-4f6b-a593-62ce43a0bd3a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620497082, "uuid": "2069fc3c-2525-4df1-b09e-79f5edbf7a74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497082, "uuid": "040ed24a-f3a4-4db3-ae8e-c642be51799f", "value": "e78d1785_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8855590e-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489638, "uuid": "6c43325a-f3a8-4e9f-8346-3b4b48370e47", "comment": "Malware payload (Dridex)", "value": "dad575f7d245ca56814963e2c86f3205", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489638, "uuid": "b6c9922a-f5aa-4f61-a2eb-17b43197dfcc", "comment": "Malware payload (Dridex)", "value": "dd2080084af2ebe00aaacf9dc0a7346cd66ba7121c662ae5f7520cf2d7c28bee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489638, "uuid": "28805729-1476-49ae-93fa-7bbca2a14a12", "comment": "Malware payload (Dridex)", "value": "09b469540459ca65406df57ca82bf9c24f1835d8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489638, "uuid": "79d2b300-3b19-42e1-b46a-3df089846719", "comment": "Malware payload (Dridex)", "value": "d58b95c7d4f8b64a3664c718dc9c09e4c254fe20985cafa7ccc2b53392363eebdb955c916e1400889605b7d9df8b10ec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489638, "uuid": "8ec0919b-acfd-4ae3-a248-f1a00b8c2fde", "value": "BCF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489638, "uuid": "f18890c0-4ca6-47e1-acac-25f1c9703560", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489638, "uuid": "9c56a29a-ccdd-4611-8259-e191f4bbf2e9", "value": "3072:oIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Bc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489638, "uuid": "1bcdd68a-bb69-443a-acc1-fc04db01a990", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489638, "uuid": "8569bf90-f065-45bf-b5b7-eba0252eb7ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489638, "uuid": "a0c614ce-8b7b-4ccc-abc1-9fc67c7f776d", "value": "dad575f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339f52eb-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486060, "uuid": "5628dd13-54fe-4143-bf8b-772184b72db4", "comment": "Malware payload (Dridex)", "value": "f7b3ccb83198bc172d0cebea97c04528", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486060, "uuid": "ec54dc09-e960-4aac-be3b-7f519ae9d39a", "comment": "Malware payload (Dridex)", "value": "dd455773dcdd91d65533f1adf1ef4c9afa16c2f8c1e42250e104667bdf4d8e42", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486060, "uuid": "513b804f-f083-4e5d-aab8-7586cdaabaf2", "comment": "Malware payload (Dridex)", "value": "ee3f48ed4e85f0f986d139fe4836f1f18e75e69c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486060, "uuid": "a33b595d-9db7-493a-aac6-5d38775bb7e0", "comment": "Malware payload (Dridex)", "value": "f9c42661bb61be9484e9c59fbccf8b2df59803422d0ad042b66bfad67cf794b2c88ce7b67892887682286dc44429d186", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486060, "uuid": "baa506c5-f1c4-47d7-931a-4ceaaa4724bd", "value": "21F3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486060, "uuid": "e0c2c66b-f8e1-4480-8ae1-fd71103e0807", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486060, "uuid": "8b3ed250-ac9c-4ff3-ac69-0158b7afeadf", "value": "3072:7e45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:a4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486060, "uuid": "b838361d-188d-4996-988a-6e53407d861f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486060, "uuid": "2bb31f63-4419-4b23-aa53-0cfbe2eed629", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486060, "uuid": "dd8e67f8-6c75-4929-be4f-f95c194dffb8", "value": "f7b3ccb8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003333b7-afc9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620456339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456339, "uuid": "e13adb4d-bf2e-4937-ad9f-cd7989569311", "comment": "Malware payload (Formbook)", "value": "7fa5e34cdc678f80f7086dae5da6c932", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456339, "uuid": "218d5dd1-a82d-4055-a310-f9013b757cfc", "comment": "Malware payload (Formbook)", "value": "de96d53592393fa5cd5dc6ed2d8d9430245ac083643591b6f060a4efc2e044d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456339, "uuid": "f5413fa0-208d-4e86-b90a-fc1ee670018f", "comment": "Malware payload (Formbook)", "value": "17a328e171beeaeb9cbf2c6fae4d1767c4f859bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456339, "uuid": "2752bc51-82d0-4bc2-b93e-3ec535160a59", "comment": "Malware payload (Formbook)", "value": "46206c7d3af9ac2517c5e38065848b34b9773728908c5bfe6a2d6b035fdfdae34e703aa59d99a93eca2973da538395af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456339, "uuid": "c3b202ca-0b1b-4cbe-8f2a-98b31a991d99", "value": "C305013923AB9F69E57EAB794021410813B5FD1A9F43E30FEFD4316E2E72B848115663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456339, "uuid": "a0797a84-a081-4fcb-b098-58c5bac45930", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456339, "uuid": "965dc72e-6ef6-454f-9869-60762af52bc5", "value": "24576:OUDSyMDa+f/7nhdLamwvR5ML/uQCCOfh:7SyMDBbmXR5MqQCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456339, "uuid": "3439b6b6-10b7-42a5-a244-1270e6299a71", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456339, "uuid": "9e3877d1-4188-4d7b-8df7-6b20922f8b32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456339, "uuid": "26c16ae5-fdfc-47dd-afb6-ee5ff8b03303", "value": "GZocMWoCzL3Rd62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e048fd5-b038-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620504197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504197, "uuid": "9f83362a-2480-477f-a1e4-52362bfce5da", "comment": "Malware payload", "value": "22996734ed8407f7a299000ae7fa4bdb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504197, "uuid": "fb1728d7-3207-41de-bf57-a8b1fa978be6", "comment": "Malware payload", "value": "de97a2b0a3a4500780ddb4cdbd5b26aa7946f5ccc83a95d103e0ee01ab5a840c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504197, "uuid": "fb5c246d-6a38-49c1-8afe-96a7064fc67b", "comment": "Malware payload", "value": "08806d71dcc15ffdc17bc8bb24bf8f5cfbdc7241", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504197, "uuid": "ba123cff-8655-4212-8206-81d254ecb738", "comment": "Malware payload", "value": "8ba59fd6e3291a271926cbe48034626055e8a47bd5de0b04bc54d498f0119a567721a54f3915315e2ad34ab4b19bf4a6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504197, "uuid": "1bc4e548-fc58-422b-8847-a489c8a83274", "value": "02F3C085DBABE87FC44A35399471DFFB5B388B149240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504197, "uuid": "fdf02962-6272-4627-a1f3-e7dffd63ad59", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504197, "uuid": "63cbc228-8245-49fc-b32f-9952389958bf", "value": "3072:de45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:k4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620504197, "uuid": "88c264d0-c7e8-4080-8e93-6b9daf5401da", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620504197, "uuid": "68a01794-454f-49bb-baa4-690418b47d16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504197, "uuid": "f74ecf9b-e22b-4832-81ca-1173301d3d44", "value": "22996734_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64650233-afbc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620450923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450923, "uuid": "78e55d29-431f-44e6-95a8-555a798253d5", "comment": "Malware payload (Loki)", "value": "8630367f74ae3f109e01d937d76cb15a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450923, "uuid": "56e5935e-786f-40a8-9ad7-a3cc7da3c7f4", "comment": "Malware payload (Loki)", "value": "deedf8e713b15ff3a42d571076eedafdea6078490412c0ecff44046ef57bd36b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450923, "uuid": "2bbe3539-4817-4636-9768-7e5244cc9a41", "comment": "Malware payload (Loki)", "value": "7c75239641e70892488c086345b2287e8f0cf6c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450923, "uuid": "4ba12590-1933-4dcf-89f4-9262bdb88c5d", "comment": "Malware payload (Loki)", "value": "08cfcbef3d689280598d013f5374e9f17f1e4465d17a95831b30102175df1b9cb6147ae305607596e681838254ed46c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450923, "uuid": "144abbea-774b-41ff-9971-28cf1f8ccc39", "value": "0CF4EF223381DB60E96E5775D4A023F023F1BC12F762DE1BACD43C9DB976AD106A5683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450923, "uuid": "cbd7273c-0ea3-4ce5-8e09-b5b7ea1e0b6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450923, "uuid": "dac3c28e-1bee-48d0-ba5f-3b7d31fd6212", "value": "12288:hnjdZoEPFKQOlMIeRQe7epRv0neaely0x5InezoFPmVxfjM:hBSKKN1WneaeVfhz6PSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620450923, "uuid": "65b3de85-cfc7-4703-b94d-20a558c2fe90", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620450923, "uuid": "6e20c715-0d2e-4437-a8d4-756efc74a543", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450923, "uuid": "d309e611-1d2d-4c28-9d91-f353def0121f", "value": "RFQ-AGS21277_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d80db64-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468065, "uuid": "e65a0afc-1d60-4912-824f-204ac4b12c67", "comment": "Malware payload (Dridex)", "value": "c4c582ef5a0c334c432d0f7a44fc31db", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468065, "uuid": "97091c14-b258-47a3-ab46-1980e7f1faab", "comment": "Malware payload (Dridex)", "value": "df01584b857e451a0778f9ccd240d090f6ff2869385079abc5aedbf8a19ae12f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468065, "uuid": "2c8d5f17-7665-4484-85ae-872ce8568481", "comment": "Malware payload (Dridex)", "value": "fede93f7d30ce857c030abec6f2c9ac6f9e69a80", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468065, "uuid": "9ec646b6-4c6e-4525-872e-cad4c4af29d3", "comment": "Malware payload (Dridex)", "value": "1ba39a456e757e4b9aecaebc8e75985f7f6f775c2a3fe0cb380c1d085178c175078b864e8fc61e0b1b9eabbd4435d2c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468065, "uuid": "eb43a129-43fd-4f2e-a6f1-d197c4df0af1", "value": "5BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468065, "uuid": "788f9237-0ae5-4e11-baf5-aba8f8c6c400", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468065, "uuid": "693591d1-cbf0-442b-83ee-3f104ef738ca", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468065, "uuid": "0a389c1e-78c6-49c8-b071-4410f6fd75fd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468065, "uuid": "1192546e-dfdf-46bf-97e5-361393deb6ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468065, "uuid": "08143a12-04b7-435e-b15e-c092715d9b0c", "value": "c4c582ef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139cba0e-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475269, "uuid": "a35300da-5d0a-4504-bfb5-6a954bfe3c35", "comment": "Malware payload (Dridex)", "value": "55bb44c4440bb75ddbff3536070497f7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475269, "uuid": "a42011c2-a7cd-4f0c-9808-e402ce9f0c5a", "comment": "Malware payload (Dridex)", "value": "e0a8d493bd4a14061455019c6f620e2ebdf6ded28d22f57937530123812c9586", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475269, "uuid": "c4c1ab87-3afa-40ab-af80-7e023857a1b4", "comment": "Malware payload (Dridex)", "value": "819511a8798adf283972a3e80abc11b541e8b2da", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475269, "uuid": "c2ef9aca-4887-49be-ba85-c098c1ae7fd9", "comment": "Malware payload (Dridex)", "value": "3b3459c528d75eedfb90317ad1e36f4efd5c4e90e2260682ce7de1c6c022dbe53ed70ba04f4236dbc4c9dcbcdbaf162d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475269, "uuid": "34da49a6-311c-41bf-99e8-b31a499ffb59", "value": "CEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475269, "uuid": "86dd58ed-668e-49e7-8799-91a3cc35c732", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475269, "uuid": "63aa5689-8aba-458e-bf64-bb98b4889514", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475269, "uuid": "6466346b-d28c-4bd9-84d3-58f259a7c2fa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475269, "uuid": "6e938651-4fda-4f5b-a9f8-98b3d39f2432", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475269, "uuid": "fbe5f8d6-f13a-4c01-9b17-8bfbc150a8c2", "value": "55bb44c4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebc01fc-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457329, "uuid": "883c8b02-fb81-4d2c-a24e-d7f8f239e01f", "comment": "Malware payload (Dridex)", "value": "b7fc516d8a907e16c253860a514cf339", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457329, "uuid": "4247b381-3beb-40c2-a1d2-12d663f0bd55", "comment": "Malware payload (Dridex)", "value": "e0cf09ba8c5411247a37190bcea379766c2dbe2805d4ec1e4501b45d4316070a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457329, "uuid": "ff26ca96-3a7c-4387-929e-a34ca8017a05", "comment": "Malware payload (Dridex)", "value": "df0c7cabd75eb32412a3a7acd1ba5286c48e696a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457329, "uuid": "89133f55-627a-49ea-a092-52c88fdfa40e", "comment": "Malware payload (Dridex)", "value": "8f7d35910b9639cdb9da73e93952b12603968a73dc6e0703295bbe65b4718cf2f03ad6d39f5751a79b0c338e285d9f08", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457329, "uuid": "1cff8ebc-4f01-4bcf-a39c-6fa5468382e1", "value": "04F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457329, "uuid": "ec320ada-c8bb-40a6-89ef-ad0c13d107ad", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457329, "uuid": "e574c80e-aa36-4dda-8ce5-b97d29e8c972", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457329, "uuid": "c79f3ad2-e59b-49a3-8315-1472685e19de", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457329, "uuid": "99fdb992-7d0b-4b05-85c9-1590951a5f21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457329, "uuid": "01c4e0f5-db58-4719-b5a3-3023ffca8485", "value": "b7fc516d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521f6c12-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "db0b9fef-8cb5-40d1-bf0e-eab6b44d9439", "comment": "Malware payload (Mirai)", "value": "f1bb6d7867fb935140634fee7f134fd2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "925e1489-d9f8-43f7-8860-75af98ae62cb", "comment": "Malware payload (Mirai)", "value": "e21927c58d3f6827d8afbe981e3e53c60e16b7c4286bf1f69a07d2fa437cec96", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "b883559c-886c-4c49-9844-ba8d33c521e8", "comment": "Malware payload (Mirai)", "value": "d0d4606daf7b2aeee253f9d14bcc7e61757e4c62", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475374, "uuid": "40312404-00d7-404d-b5cc-a0855b242356", "comment": "Malware payload (Mirai)", "value": "2567bb149057a7124ff8ebe5581b9c9fb49e70cd978f14493c8875059f6c6229e2e7f26d41fc599a3eeee309e659718e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475374, "uuid": "c4ef00e9-c0b8-447b-8bd1-6a7018cdb173", "value": "EB534AC8A5C3E5F5EC001D79307BABA1A973F53F2035EE9BE79A25639902603E10169D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475374, "uuid": "0336d529-e3ed-4310-a7f1-1283844aae3b", "value": "1536:V5Vn4pXoqVExGxRP3MFnKiNjiKO18HKaPWyZnUnD9oAG9b:7R4pxuxGxB3MFnKGiHCHKm9+VK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475374, "uuid": "9982a773-95c4-44eb-9cc9-d15abb9ccaa7", "value": 63696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475374, "uuid": "5e2802e7-a9d2-4c3c-80d0-fa54404bfb95", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475374, "uuid": "9d74ab3b-f81c-42b5-84c0-1d8935e52501", "value": "KKveTTgaAAsecNNaaaa.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67cac592-afb5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620447923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447923, "uuid": "e59f946c-ea27-40ad-8a13-6908c02bc25e", "comment": "Malware payload (Mirai)", "value": "72df1037313935c0a2dcf4d0e5a69118", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447923, "uuid": "2633374a-c716-4063-ae3c-3f0bfd5e16b5", "comment": "Malware payload (Mirai)", "value": "e284e15192ed33f76d6cffba5529adbbb557cdfedf2929b5c497232b955ea164", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447923, "uuid": "316426b6-eecb-42b5-8c9c-8ea10fb0d06f", "comment": "Malware payload (Mirai)", "value": "23c1ff0074297c2a17025526a10b66f9bc687a2c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447923, "uuid": "68b043af-2e25-489d-a3dc-c39ef7ea5b81", "comment": "Malware payload (Mirai)", "value": "7223e260d0b8ff9ccfb5f01cf6c4b7b3951c433d83c7f94c044a63da9ad08ed65309206f087c6b3e5242b8d3d5507366", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447923, "uuid": "3010432e-b9d4-4f7f-b24b-13910ca7dbc1", "value": "8FE2E1B3D5E48AB8E0AD80B3354F7A181D70339CC92931B16BEC761FE415AD42F69725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447923, "uuid": "9261a85d-664e-4e05-ba1f-c6bfa1f4b741", "value": "768:BwTv2xHfG2iY5J+nZS/p1QiIFrGLeOtRSE4/+nbcuyD7UryqP4:STv2xHOhY58ZQpfIFr3OjSE4Gnouy8mL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620447923, "uuid": "340cb0a4-a189-4204-b03b-2e4987520ab9", "value": 32004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620447923, "uuid": "666d98e3-a084-49ba-b8bd-e2f09225f2f9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447923, "uuid": "7833e1ab-88d7-417b-b2fe-f734c9770a9a", "value": "I686 (1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517501ca-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475373, "uuid": "dc90d4ab-f17b-4659-ac15-fb7aa69d004b", "comment": "Malware payload (Mirai)", "value": "ed6a880c7cae4551355be8a01c44e350", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475373, "uuid": "47056a2e-4100-4d01-875e-b70d7efe996a", "comment": "Malware payload (Mirai)", "value": "e2b9309a4b2aa5d310358581fe64ce6cd7cf3fbce979615ee509dccb2d33d735", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475373, "uuid": "8647cba5-7b28-45c4-83ca-e3c8f626570c", "comment": "Malware payload (Mirai)", "value": "9cb26fc35ec102563ba9408b0c389dbef35a1339", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475373, "uuid": "743f8f88-3e89-4724-ad9d-cd51b5b9d41d", "comment": "Malware payload (Mirai)", "value": "0d2007a741cc8780571622866ba151144a4f00302d0dfe8ddd40171b25ded8e538ee12538867268a7a9477c6fa72cb4c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475373, "uuid": "9710b944-c67a-4e06-903f-875c058bb2cd", "value": "C25329C8E593F8F5DC140978306ABB66AEB3F13F7135E99BC3D82927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475373, "uuid": "448457b2-4070-4f9c-bbbf-9b431c218118", "value": "1536:IcR9170vwHbQXZ5+qXDEuXi9bLSW7p/d6reFt6HuQ4Zf:f917iwHbQXZ5+qXA59HSWF/Qreb6OZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475373, "uuid": "7f1f0a49-5a6c-483c-8abb-e0202ae6098d", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475373, "uuid": "c5b36668-14a0-4beb-968d-ad7eddd7a439", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475373, "uuid": "5decf6a2-b85e-4d24-b237-5753ce677b49", "value": "loligang.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e4e6e8-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "2c4f476a-5e90-4e17-a6de-b8dc9f3dddce", "comment": "Malware payload (Mirai)", "value": "c5f6d3d8361a11746509f1766ab75527", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "f2c5fb86-c975-4dd1-992e-388eef49aeb3", "comment": "Malware payload (Mirai)", "value": "e350448ffe4ab99595d54fad2625ea100f34e0566b31131d57bb2a8b292b30d5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "d53cd0db-5c84-44f2-a46d-b85f2add65de", "comment": "Malware payload (Mirai)", "value": "678cca1917cd5f280612abe7b5e5ab8d8f4764e4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475384, "uuid": "7b6f78d0-d75f-49a3-93b7-01a1b64d7e81", "comment": "Malware payload (Mirai)", "value": "48c5e9e6489151fa1ea2f44e2fbef0d064d1838cbcbf3c9f578913f05cf5088d7ba98cd18c8293442720db8681ba1fe2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "7bd34d33-401a-4b09-9fb2-c25e23e4801a", "value": "FF33293179392E17C4D0A87A62F74758B2F1165E65E8CA4EBC730E4FFF10A50A5136B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "3387643f-3a4c-4a8d-9796-532e29652ba2", "value": "768:iGo2om3yq9YeZCw777l1HObhnIwPBIjIvNO+9hhwk:iGhom3ySY+Cw77J1HObhIwbv9Gk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475384, "uuid": "add8cfdc-7514-4752-8a15-805d33d3d774", "value": 50676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475384, "uuid": "7f6061c1-343d-4127-937f-22e68b4871da", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475384, "uuid": "489d198c-22be-4f92-85c0-34351979dfa4", "value": "Winbox.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8586ee-afd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620460092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460092, "uuid": "a7692542-0ce2-4400-8eb2-0adc409aa069", "comment": "Malware payload (AgentTesla)", "value": "059aa398b15a9cc30199eff6067710af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460092, "uuid": "0baa3455-3ef2-45cc-b37d-65eeb809ca6e", "comment": "Malware payload (AgentTesla)", "value": "e36518d5413db2a778a3502a092c07b5ae99d7e9e27756b5a4c391a643135640", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460092, "uuid": "97babe44-0eeb-4d43-8a77-4058316acf2a", "comment": "Malware payload (AgentTesla)", "value": "60fcb46581bd03d3e452bb70b65d77d3cc4c1656", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460092, "uuid": "6db752d3-0a14-402d-a1b7-e104473f63f3", "comment": "Malware payload (AgentTesla)", "value": "104ad949f4069f2c6486d7e86dc402cdb13f57945be598da48b5ee1d82ba8813640d45eb10365ef5f3fa72600fe52f87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460092, "uuid": "3ec09f8b-ca35-47b0-85e2-9bd539452e9a", "value": "CDE412AE03CC8B29C59FA43CE8E1A957C376D5477443EB0489D595BA5E233F067023AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460092, "uuid": "d7e5da78-44cc-44c7-a965-52d491ddd589", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460092, "uuid": "23624968-c435-411e-85d1-f829f972c8ea", "value": "12288:stFswgSHmbJHggnlSDvNgl0WvY6kDRoSWWIYARIchZLFTWdut+Q9PMisMuPO:mY1AUOlgp8DRDcHhZLsdut+Q9Uis9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460092, "uuid": "f38673ce-d664-4cc5-b6be-0f4f347ad841", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460092, "uuid": "8598c121-8238-4d43-8622-1ebdaff48277", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460092, "uuid": "2d83fa73-73ab-4865-aa08-7d7f08ae1dcc", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561a7e4c-afe9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620470227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620470227, "uuid": "bff6093d-fc5f-4265-9b6d-1e5ab7a1537b", "comment": "Malware payload", "value": "2562647e76b570b193bd7efb504d33e4", "object_relation": "md5", "Tag": [ { "name": "encrypted", "colour": "#F5A925", "exportable": true, "hide_tag": false }, { "name": "encrypted!", "colour": "#B484FD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620470227, "uuid": "63f3127a-5283-40cc-9b04-047c9477b818", "comment": "Malware payload", "value": "e3b556b6148061be97b70d2c0dc47d226ca75c2293f5de70efc7cdda86661417", "object_relation": "sha256", "Tag": [ { "name": "encrypted", "colour": "#F5A925", "exportable": true, "hide_tag": false }, { "name": "encrypted!", "colour": "#B484FD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620470227, "uuid": "6896cdbb-8cdd-46ca-8390-c6b6e77db1c3", "comment": "Malware payload", "value": "ee56cfcc3fd138ac5f5fa7d7e18d48227941e3ee", "object_relation": "sha1", "Tag": [ { "name": "encrypted", "colour": "#F5A925", "exportable": true, "hide_tag": false }, { "name": "encrypted!", "colour": "#B484FD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620470227, "uuid": "6723f75a-3e7f-4205-bceb-6750bb75b291", "comment": "Malware payload", "value": "46ea0734a37325ddee74f154b05f02eb624bc916214b3c4c756506f34892d4ffcc762b9bf66f773891fabfacca0cf98b", "object_relation": "sha3-384", "Tag": [ { "name": "encrypted", "colour": "#F5A925", "exportable": true, "hide_tag": false }, { "name": "encrypted!", "colour": "#B484FD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620470227, "uuid": "3ec7525e-b0f2-4860-9464-d0d8bd7b01c8", "value": "2013F1E33E6EAC25CC015D7A3692C8324796D041731F4BD668CA5AB3AEB5BC1C236163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620470227, "uuid": "e9dd1311-3063-4db1-964c-9b6b856f2c96", "value": "e76c6ebb259337a0f26e3cdd8f85ac5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620470227, "uuid": "a863315a-8675-406a-9c08-e6b3fc845af7", "value": "768:gkCbUJBnzxWKxQoGnQTR9KVUMmW2ZREEpdEFsbBmsHJ8ulel01c:gCJBnz0GQoWVwRECEFsMwJ1lel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620470227, "uuid": "08caa04e-5b33-4a01-a6de-b76fa5935e94", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620470227, "uuid": "c985e5a4-3fe2-473a-bca4-2c21ee5712bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620470227, "uuid": "4ce45daa-630f-4419-a268-d19b88ea7739", "value": "r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fde2b99-afbc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620450916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450916, "uuid": "ba3dd068-417e-4318-81f4-a4b4250b3ea7", "comment": "Malware payload (Loki)", "value": "ca0d509b6ed3098e589ef16fc8e900b1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450916, "uuid": "41b788a5-2113-4469-83ab-8312896ec6c1", "comment": "Malware payload (Loki)", "value": "e47e486c7a41e027316eb01cf4b9a93f847933566e84ae178eaa99d5accc4d7e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450916, "uuid": "f0ed8073-d263-496b-9f6e-c112c9fed16a", "comment": "Malware payload (Loki)", "value": "8fd515b69405faf1fe7206ef91f6b660a1c3b211", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620450916, "uuid": "16d5df92-6313-42a1-8cd7-71860930503c", "comment": "Malware payload (Loki)", "value": "589207e8fae4694d955367c0a90d2e0b8c43d17b2b3147bcccad68e941a73fca731708638fa9343d1f851cfd409d3c6a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450916, "uuid": "012c293c-19ff-48dd-9d07-714e10a42bf4", "value": "5BC4239F94D34DD1832A56520C7E0F67060D198372BBE46684E622F6E690BCE7FF40B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450916, "uuid": "f7fdaab7-8204-432c-bc1f-1242bb7a2b87", "value": "12288:+9TeCfzfQjxMaxO+MZMPP3P0pOPkYIZn6p6y/GNMLWHujrQGgNIcNRDcxBxSo608:ue44xMP+P30pOPvI4aNMKHujngO+cxBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620450916, "uuid": "72c449cd-edd9-465b-979c-320e5671965a", "value": 576389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620450916, "uuid": "dfb334df-1258-4996-9bf8-e517816743c8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620450916, "uuid": "43f871e4-80ed-4fb4-84a9-ec8f26bc21f5", "value": "RFQ-AGS21277_pdf.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d947f1ae-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435658, "uuid": "f46651a8-d968-48f3-b15e-05a865f2a168", "comment": "Malware payload (Dridex)", "value": "e0654271c264415c25dd5600d7f5b10c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435658, "uuid": "8a585fea-93c6-45f2-9ec6-fb9a33cf7fa2", "comment": "Malware payload (Dridex)", "value": "e49628a4b89aaa7534f1bf84f630a8657ee797660d0300b4c9267a935211413d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435658, "uuid": "b2af5fc4-3637-44fd-926f-26688ccf86b6", "comment": "Malware payload (Dridex)", "value": "41298e0e03f0ba7b9b5b3b11e3ba510f66d55097", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435658, "uuid": "c65403f3-2793-4cf1-9b31-04f2d4ec2732", "comment": "Malware payload (Dridex)", "value": "7441a05c4b6baaa5839d1bb49e0c4fc527eaae34c41f908a02724cd84b058dc7cb79e9a56bafb81ee91225d9f09d52a7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435658, "uuid": "cf25ef30-1cd3-4eb8-beec-35276b98ec52", "value": "AEF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435658, "uuid": "490366c6-0278-43a3-a27a-e6a80ea7993e", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435658, "uuid": "4432dd8b-b027-4882-b6e1-a410d074a075", "value": "3072:ae45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:34KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435658, "uuid": "66b5ff55-0e54-4672-9ceb-381713cb23d5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435658, "uuid": "06f140af-4692-40d9-921a-28bf46385c46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435658, "uuid": "c735eeec-351e-4cb5-8e00-a0c1cfee2120", "value": "e0654271_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c931edf-afe4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620468036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468036, "uuid": "244d3d01-9905-49f5-af86-9231f41810b1", "comment": "Malware payload (Dridex)", "value": "4bfcaae40ee9351a2f8670efcdcbfa95", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468036, "uuid": "9707ba38-ebed-4d0b-975d-a45141b18110", "comment": "Malware payload (Dridex)", "value": "e528aa9bbf70eaeed69f66e0adfe7287b788fcc00a8391270a342ff74efad11e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468036, "uuid": "f76a5db9-3bc1-4c60-be54-94afd65167ae", "comment": "Malware payload (Dridex)", "value": "e7d9618ee38b9386b249fd29aefb18af548b9358", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620468036, "uuid": "c8137a6f-c8e5-441e-9092-75e97d4773b4", "comment": "Malware payload (Dridex)", "value": "a1e36a6f1ca1024bd19555f5d5dcccff20b7de6cdbd9fdea3e0f5153d49fa947bb00a9aa2a48f5839fd85dd0afa2ba49", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468036, "uuid": "7aae562b-7145-46ed-8bed-f76247ca3387", "value": "7FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468036, "uuid": "ddd7ea4d-674f-4ed4-a4f1-bc52931773eb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468036, "uuid": "0cb48252-e06c-4a9f-b44a-131e65378413", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620468036, "uuid": "8609968e-3e58-4967-b83d-e93095328e94", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620468036, "uuid": "98fb672d-d4ad-446a-bb9c-4662ee55abf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620468036, "uuid": "730d1fe1-8d96-4ea3-8496-2f25bcedcdb6", "value": "4bfcaae4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8596ef-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432093, "uuid": "e0c02237-062a-41cb-bcc5-7ae9b6b24799", "comment": "Malware payload (Dridex)", "value": "4c641b835b6175923bd2ab47bbefb0d4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432093, "uuid": "6b162bac-b818-4a0e-9c6f-a304ece9bf7e", "comment": "Malware payload (Dridex)", "value": "e57ed542e07e9ec8f9f24b0e18115d492ab6536d3a32efe9451f09e2efd1b91d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432093, "uuid": "29a56f78-2ed4-43b0-9c00-0f4f05d8f5c2", "comment": "Malware payload (Dridex)", "value": "f31e10f1d9ae87b2309553d1ee0a174469186cdc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432093, "uuid": "7dcceb51-db13-4021-8084-f917b6cd8238", "comment": "Malware payload (Dridex)", "value": "cac0b770a809992a9baa87cfffe44398ecb8c9549209eac8d83f18271bcea8934a56a9a251cf9ddf30bb5261708228ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432093, "uuid": "884931d8-3657-407f-ba8e-f592cc9c5904", "value": "45F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432093, "uuid": "182dd060-0248-4c10-8a3f-044cbfd53ae1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432093, "uuid": "436961ca-6635-4736-ada3-f9909250d95a", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432093, "uuid": "d9e7170a-b9d1-4eaa-95f8-95ae4ad7751e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432093, "uuid": "2b000f40-8319-4294-a7c7-cbb85dbddbe0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432093, "uuid": "ad64b16d-d654-42ef-9336-a4f11d7607bb", "value": "4c641b83_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71ddbfe-afbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620451465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451465, "uuid": "373bfba4-fd12-49e7-baf2-1b6e09765659", "comment": "Malware payload (Mirai)", "value": "73ac2ec46e7e1938f846558bf5d7195f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451465, "uuid": "cf481c40-1080-4763-b744-3d1f96ca6984", "comment": "Malware payload (Mirai)", "value": "e5cb14dfaf43df932d544ce13512a7d7c39932e41013a4a08d388db655fb3fe6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451465, "uuid": "d9d0de2b-b981-40df-9948-03743385e588", "comment": "Malware payload (Mirai)", "value": "81c62ff472fc7b5cc67aff6519e955b4d4e2b6f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451465, "uuid": "fa60486b-3a32-4e22-bd9a-bd287f0b0c4f", "comment": "Malware payload (Mirai)", "value": "52394dae8f4359820eb49b127f140a543cb66ebbec075c63ac161fda5351ae83c2d1155c1ec805a75f0b2c0348e4ed21", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451465, "uuid": "9f4b5369-d733-4eb5-b56b-78d8320e675b", "value": "C2633B46EA87F9F0CD450AB8105BAF75C436A8333130DFEBEBD8B9179D56742605226C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451465, "uuid": "6ac6a039-ff6e-4704-a2cf-b48eea5d3858", "value": "1536:IeAolofbYYQsBehM1XcB3xNSOUd3dgi8Sbm7mm5:IeyssLcBAlXbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620451465, "uuid": "47aa8a52-49a2-43a2-a6c0-c4cb86d011a3", "value": 70232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620451465, "uuid": "17dedc3f-4620-446f-b548-7e5cdd62eaa2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451465, "uuid": "d8ea0e8b-e045-452f-a87f-926b79c07c01", "value": "KKveTTgaAAsecNNaaaa.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1cb46a-b021-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620494508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620494508, "uuid": "4727f0b4-78b8-4d36-9a70-9c21219e56ec", "comment": "Malware payload", "value": "6dab0adacbf99a4870eea3ba5e50203c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620494508, "uuid": "22b57dab-e145-45d7-92e6-2fed9aca5276", "comment": "Malware payload", "value": "e70dc307eaf88429650359397c74ae88663df1cfc05b8e97f80d0bad758986ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620494508, "uuid": "d0b72a60-8139-4595-b907-b5efe0ed1b2e", "comment": "Malware payload", "value": "b674453f925202773462ce00499fdb6a9cfe9484", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620494508, "uuid": "76a337c4-e40d-45dc-aac0-d5275162b4ae", "comment": "Malware payload", "value": "0dcb537eecf6c3c4c5a74ea4443c89e716bc8b5e4286c135bc040641ff09cd281200821bc90f6da4580c4808cada1774", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620494508, "uuid": "2e6ac17f-52fc-425f-8c35-949755201ce5", "value": "FF048D7CD752EA12E07E1730D1D76B387E76ACA83361420341A6BE193AAF3D97D16B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620494508, "uuid": "4ea28eb3-dce2-4404-be02-d59b98ff8180", "value": "fc693e6431213c293d73a06ce22ff9ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620494508, "uuid": "cc067cdf-8baf-4eba-bb86-566790c47368", "value": "3072:nqn8swZo+N1kF56rwOixLuY3I4NkxDVXflF2FIPy:qn8swZo+7183LuVXflF2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620494508, "uuid": "d23fb5ca-838d-4d6d-a87a-a9e7f207a286", "value": 181760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620494508, "uuid": "c17d489f-0738-4638-96b4-3d53b6e8d70b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620494508, "uuid": "b6116cf6-94f0-4dca-a5e9-9a80455b0e78", "value": "winupas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229a6322-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475294, "uuid": "f942a168-1e42-451a-bf60-7b6a0a9312a5", "comment": "Malware payload (Dridex)", "value": "df6c9ded8e0602542e45f06e70d8f93c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475294, "uuid": "9f180afe-08d6-46ce-8e42-18c3f25c4b58", "comment": "Malware payload (Dridex)", "value": "e7d18b746dd60eb86ad7e914e4d6f48239543d222c12f59e8493dbef856c33b5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475294, "uuid": "bbbf5d7b-d63a-460b-b4da-8609ad26ba58", "comment": "Malware payload (Dridex)", "value": "da68e6567cf6040a9b92bfe4ef6e5cde4d8abbd2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475294, "uuid": "c38f6670-5579-4265-abc5-9ea03d142f13", "comment": "Malware payload (Dridex)", "value": "94ef40a5d8c6543dd49ee7e323cae7b763296075e7ca70a87a84f633c18a5a7cffe027e5d85763073587982cbb4cd2ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475294, "uuid": "1d2cd148-38e8-4d90-9feb-c013bec973c7", "value": "46F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475294, "uuid": "9aa00934-76e4-48a2-bbf7-d6a73be2d3a3", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475294, "uuid": "c1475b35-a42c-45f4-9989-4fd67d8a6b8a", "value": "3072:QuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:Q0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475294, "uuid": "32bffec1-9eee-4f29-887c-31110fbe5e37", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475294, "uuid": "18f1ab56-aabc-459b-88bb-bd0fd0a34c48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475294, "uuid": "e10891d7-6684-4f66-b9ef-539f479f1d50", "value": "df6c9ded_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a730483c-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489690, "uuid": "31d642ec-048f-4315-b67c-99f86a551b80", "comment": "Malware payload (Dridex)", "value": "c4850994096efa5ba3b4bf1598131d2f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489690, "uuid": "161a58e6-2b2e-4674-bc7a-29611b44b8b2", "comment": "Malware payload (Dridex)", "value": "e8760580c7f034a6abdb7d45a6e77d348271b6a78824eb8e954129f79ac295bc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489690, "uuid": "441d1c86-57af-4040-a455-d145b8cea8a1", "comment": "Malware payload (Dridex)", "value": "de09d7728ab5d702681d2a1abd3ce22013b02b00", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489690, "uuid": "f87731e9-e187-4f9c-b43b-8634881a3e20", "comment": "Malware payload (Dridex)", "value": "abbe25684ded9824537d6172fcb0f4094deba2a0a5a11472c659309c0fdec750dbff1cd5689fbc8551a6f53c3aae0327", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489690, "uuid": "a8ccafb8-d8ea-47e3-9e4d-ce5d0475a3de", "value": "E8F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489690, "uuid": "15d581bd-4c8d-4d29-a927-98d4b5bad82d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489690, "uuid": "81f188eb-45be-41e3-b05d-689d8796cc2e", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489690, "uuid": "0f3d9569-59f0-4592-b97c-fd817ddfd527", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489690, "uuid": "8ceb2c9b-9f87-415f-8bcc-00207696da15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489690, "uuid": "1c8dc8d2-4c33-48e6-b4c3-01da84b7bce0", "value": "c4850994_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13346ca4-afb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446492, "uuid": "af387ef1-b051-48d5-9a91-9de3a3dbc9b5", "comment": "Malware payload (Dridex)", "value": "cad82ff8486e1b73c8a3a88b04138183", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446492, "uuid": "e2a20734-baa1-4c07-9801-8051d71af9f7", "comment": "Malware payload (Dridex)", "value": "e939e67e70c5b77228d6d56e74d7bd870e19e8e8c0a285d656bda29888e01fa7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446492, "uuid": "ac01eb3f-30ff-44c2-9ba4-f40e7ef9f994", "comment": "Malware payload (Dridex)", "value": "0027c860b47198cd7c7182aef82cd21fc4edc864", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446492, "uuid": "ed970bfe-a3d2-4376-baf4-bd69cc86e642", "comment": "Malware payload (Dridex)", "value": "260e65c547c60f62b59b4bcd9ebade0c42fa32040ecb687636f5a62a11a8736410c1317d106797efe56253c9b0aafbf0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446492, "uuid": "cb81d0b6-6e14-463c-8bcf-08ab445044ab", "value": "2AF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446492, "uuid": "343bb234-34e5-457a-96b0-3f696cf89303", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446492, "uuid": "f995f4f6-0c5e-4c48-9a74-85b3463f3f14", "value": "3072:HiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ceAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446492, "uuid": "b7ff02d6-fe40-4e3d-9063-e84cb98aa8a2", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446492, "uuid": "5a98ad76-d109-45ac-95b2-5266f53dcd2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446492, "uuid": "e863f18f-a9d2-4968-84d4-f1f73cdbd819", "value": "cad82ff8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f12b8a-b01f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493688, "uuid": "0c2399d1-60bf-419f-98bb-8ff001363817", "comment": "Malware payload (Dridex)", "value": "d8c31d34ac6fabcb4e6b3a26732767e9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493688, "uuid": "71d33cdf-10c0-437c-a20a-63c2b4c49275", "comment": "Malware payload (Dridex)", "value": "e98766a3d1b12bdf804189d2c07e1cbf344044c049a5a6a02abe7f84749e8c03", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493688, "uuid": "4624726d-32b7-4818-89ac-458c0149c500", "comment": "Malware payload (Dridex)", "value": "866e6dbca35ebc875a5b52feb790dae5acca174f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493688, "uuid": "f49c2dd3-fd8d-4301-b4cb-1ae86e087814", "comment": "Malware payload (Dridex)", "value": "45dff982ca1ff0f002168c252bd01c0ccfe27aaa4caf42a203a3bac9458f8e73015dc35005f8c0db22373f81b39f54a7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493688, "uuid": "5c6427e3-d3e2-4af4-9e58-506d5c3b1d1a", "value": "9FF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493688, "uuid": "b4c83c0d-9a1f-431b-9176-ff8cd359f952", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493688, "uuid": "b34f0ed2-1c82-49fb-a479-36e89eeff7e6", "value": "3072:aiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ZeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493688, "uuid": "b423369c-a8ae-4abd-af85-02b9909f933c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493688, "uuid": "a6811ad9-47d7-4c87-a6bc-d1a819c76bb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493688, "uuid": "c604b8f8-c2e3-48e5-8344-ef1bcfca9889", "value": "d8c31d34_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7defa8-aff4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475230, "uuid": "09c6fee3-6523-4ac4-860b-29e1f740b329", "comment": "Malware payload (Dridex)", "value": "c72b27414064801c81a9519d6b130fa7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475230, "uuid": "45de88be-1833-4799-9351-ec688a86472e", "comment": "Malware payload (Dridex)", "value": "e98e46ae2135196df39bc6b3789b134a8161e66b76238bcbdfb56485aad71a3c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475230, "uuid": "1b8cb413-5b4a-4126-b694-c787598aeda2", "comment": "Malware payload (Dridex)", "value": "70c9a3964af2ca9db2f1c099c6526e5ed077f8dd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475230, "uuid": "e106a834-8a0b-44e1-b1c4-5ccd31468058", "comment": "Malware payload (Dridex)", "value": "02bf8a6e0814ea64c61de5cf8b4e02f4889387dbec3a7536c81f3798e297d15b7a0df24857af10a97751d4feb9a7bd85", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475230, "uuid": "1a07c3e0-b2e7-4908-b732-91123666c06e", "value": "3EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475230, "uuid": "3dce781b-1e54-4dd8-bc00-2a514a62ef52", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475230, "uuid": "5c067d27-59b1-40ec-a306-707618e55336", "value": "3072:+lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:+lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475230, "uuid": "29ce5fdb-3b77-4c94-b9fd-8201dd6f5174", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475230, "uuid": "9b3acf93-7285-4535-ae84-a1e16f9a4eb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475230, "uuid": "371e7c72-1a7d-4f2a-9d59-4851892d16b1", "value": "c72b2741_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a314ae-afd7-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620462599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462599, "uuid": "f12acaac-59b4-4264-b792-9056f6eff87d", "comment": "Malware payload (ArkeiStealer)", "value": "bbffc3df8804d72ec64bf851e316b233", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462599, "uuid": "9401a0af-efd8-4ba9-a318-27982b5530b0", "comment": "Malware payload (ArkeiStealer)", "value": "e9a341bafeaba15c7e73a7ebb64f2c6463f23f6fbb83417943b4429ef00ab00e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462599, "uuid": "f9d14454-844f-4346-85f8-414fdf6fd011", "comment": "Malware payload (ArkeiStealer)", "value": "45dcfb6bcb80179a6d4324f2c574da9320943c99", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462599, "uuid": "09868340-0499-4577-bd64-7b590ce23d02", "comment": "Malware payload (ArkeiStealer)", "value": "aa71cf052d8ec8e632c483dc54bb9d39b1cb362f11c193f45fe4cc21ade13a187050a9125d24071b510326514c281aae", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462599, "uuid": "b525a6f1-d13c-4324-94b1-e04a1b6ae3a3", "value": "35E4F1213581C032CC761D764425CB795E6BB8339F215ECB9A8D27B9EF247E27B2434A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462599, "uuid": "4596d159-ab0a-42e2-a3a9-56a999a8bcdb", "value": "0eb744574666f2607e9c304d58194156", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462599, "uuid": "0601f611-7378-4f1a-9d77-80f701ae85e6", "value": "12288:pVfzWy5eeIIIgjBIIwDVhYK5VaZmTzNA5OJqbVJLmUx:pVfzWyEeITgdIIKYUAaJqeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620462599, "uuid": "959da39b-c76e-46be-8556-a7295403b6db", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620462599, "uuid": "db8aa364-de1a-46ce-834d-4e8202fc7178", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462599, "uuid": "6b709150-5901-4356-ad90-5655a5ceb05e", "value": "bbffc3df8804d72ec64bf851e316b233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6fb4bec-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442875, "uuid": "5feec8ec-1e61-4c37-8588-a148ed26c1ca", "comment": "Malware payload (Dridex)", "value": "6761ad8db2ec86569b9ccc63ea80eb04", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442875, "uuid": "72e31c0c-3d3d-48ff-9db8-be237c4c43bc", "comment": "Malware payload (Dridex)", "value": "e9f38f74dead81e391fb2c0f03688bf26abab96514cb582c7da141362a415cef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442875, "uuid": "747c3451-ba4f-47f0-b372-66f9046e2e8c", "comment": "Malware payload (Dridex)", "value": "58eab8f4ac4102f553a26eee67a349c29bb428be", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442875, "uuid": "f63cc297-054f-488b-a1cb-fbf453ca813f", "comment": "Malware payload (Dridex)", "value": "49c298dc380ce473d6b490c7a93481674d5ce3f776794cb295f2c08923ece88b27e643edd1a0ffd936b1352e39726f02", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442875, "uuid": "7b97cf77-c027-41f3-8841-4fb191a13308", "value": "67F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442875, "uuid": "9faff452-c750-4eac-ae72-7cd21e69ada9", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442875, "uuid": "ca403612-3b17-4097-897f-65bcd7354a36", "value": "3072:qe45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:n4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442875, "uuid": "d77c1dfd-2606-4774-9508-7886e1459481", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442875, "uuid": "0b8bc48d-1532-44db-a95b-b76e13618dfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442875, "uuid": "6ef02800-1364-4e10-b65e-b2cfd27dcabc", "value": "6761ad8d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5fe47e2-b040-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620507727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507727, "uuid": "cf23c267-cf14-4f96-84ad-702632c98a12", "comment": "Malware payload", "value": "2a250c595856d94cd5143c382f17f1f9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507727, "uuid": "4d0cbbc0-e40a-4f20-8365-d6d7ac646783", "comment": "Malware payload", "value": "ea08dc79e7a83e249391eb7e48ff2a3e0a33d4c57adb8fc9caeedfeedcb2e14b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507727, "uuid": "f63da0d5-b8c0-44c9-8a86-e6c0993e18f3", "comment": "Malware payload", "value": "9e4a5e028454ca24df5e6be6947e9c9af8ed63a2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507727, "uuid": "33352c14-4a85-4e29-ae90-7d5238018610", "comment": "Malware payload", "value": "bba4a9dd1cbe6cef28d05b4702d0f44004050a09ffa39b09113ed23423059ba0b0ef65f68d7938f9ad5944c2f87c5061", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507727, "uuid": "b1935f47-c087-45a1-a85a-3878d194d77f", "value": "D9F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507727, "uuid": "767dc5c3-84a8-43ee-9108-e2a3c1fdaef9", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507727, "uuid": "5e03dde6-66b8-4d0e-afa9-3435ff086343", "value": "3072:miFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:deAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620507727, "uuid": "093fb197-965b-4ce5-a22b-30ebc8dce255", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620507727, "uuid": "81fc60cd-2b59-4fc3-ac38-c2e00fd64f71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507727, "uuid": "0b2652be-18fa-4967-9f49-f58d55804252", "value": "2a250c59_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb7002a-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435641, "uuid": "0f1d8fe0-0072-43b0-953d-d28fabcf14e4", "comment": "Malware payload (Dridex)", "value": "7618e6091deb8c151d630bf76825958e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435641, "uuid": "0672ea82-bf9e-4173-a514-79d0604febd2", "comment": "Malware payload (Dridex)", "value": "eb310b1436e76a6a1347524200cd8a6b3f3364a0638784faed9915f88da2185d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435641, "uuid": "34b63dfe-d8ba-44ea-9281-629e968611de", "comment": "Malware payload (Dridex)", "value": "f48cb9a2e3fc8734757658e1ba1a4b8cc43f4fda", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435641, "uuid": "7eb2127b-ad5f-47fe-a843-7d63a9930b99", "comment": "Malware payload (Dridex)", "value": "866186c491e610348b57c15481a16c5656ddff32998d2a84db33db56acae7c6750a418f7eec2cb71d1663c64d8e72bc3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435641, "uuid": "cd59ae10-89ea-42b4-869a-1c515d34ea9d", "value": "5FF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435641, "uuid": "ba350dbe-b44d-4d0a-a970-4608d4c4342c", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435641, "uuid": "607c81df-750f-4c51-a1ac-60e2c3fbbee2", "value": "3072:RiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ieAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435641, "uuid": "8b8613fe-aab1-4ef8-8868-3dcba21362c4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435641, "uuid": "0f4a4ed4-5cad-4f02-9499-046a6f7e5121", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435641, "uuid": "a1128075-ea3c-4028-97b1-7dcf399473fb", "value": "7618e609_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9378b3f9-afbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620451432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451432, "uuid": "70c4263e-a5dc-44a6-bf0a-1e9da1d0513c", "comment": "Malware payload (Mirai)", "value": "4d71dbf7f9fb0eeaa323ccc9a7f9cc4e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451432, "uuid": "aca86bb6-22c7-4058-8864-157d09e873ab", "comment": "Malware payload (Mirai)", "value": "eba3fc952abc2f10cfa102eac2ff7f185f4ff111a356b7615254c25407045da8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451432, "uuid": "9d4ed9f1-50ea-4b14-bc02-b6f23328bc24", "comment": "Malware payload (Mirai)", "value": "ba3069cdc6d5860884bd940ef92a81d34ae5f6f0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620451432, "uuid": "8c40be51-6de9-4de3-9b7c-319f266d2875", "comment": "Malware payload (Mirai)", "value": "15839205ef01cdd31e9f57570cd9788dd02b0a4a562ff2e58ec157858aba2bfa39c0cf1023a2cda6a8cc4a1a8e20ffc0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451432, "uuid": "9ee5ec8c-cf51-4519-a5c6-0a339b2e3c57", "value": "7B730A86BC809A10C6C50777FA2F218D33075799F2DE7352CE155FB47B8B81B0E2A65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451432, "uuid": "36eee79e-44e6-40e5-9453-1fab3d9683c1", "value": "1536:CqnWdybtD+qlZYl29nQuKs+GHMlLND8J70qNdJ1uuzcgISiih51mhW:KdwLlZ229nc5GHMEYqNH/h51mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620451432, "uuid": "4c4053a5-2786-4d39-9740-f2a34cc22a61", "value": 80536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620451432, "uuid": "ebe05794-da66-4b2b-b29f-0fa41ef5af9b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620451432, "uuid": "4222d014-26b4-4142-a34f-0ebdf0cdf4d1", "value": "KKveTTgaAAsecNNaaaa.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7dbeae7-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435655, "uuid": "310c764e-36b3-4da9-9218-dba3fabefb98", "comment": "Malware payload (Dridex)", "value": "debc67619101a6ed976a86a8797dbd8b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435655, "uuid": "399b623d-825b-4d70-833c-001830df6afe", "comment": "Malware payload (Dridex)", "value": "ebf45ff1edea98bc3603af485f08fd65e8196b08c9c0311fb62db96293bbf054", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435655, "uuid": "d4630059-fac2-42f4-8ba1-b687c2f963e7", "comment": "Malware payload (Dridex)", "value": "3f1f893b7b8e7505526bd7d16144646b21748614", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435655, "uuid": "3722aa2b-a9fa-416a-9af1-dc3002e9eaa2", "comment": "Malware payload (Dridex)", "value": "3ed8618860716de1aed278b30789654f366eb2fcc784063ef357047a82c2a4b39898ab88757d3d26dd2b739761efa877", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435655, "uuid": "9fd05976-cdfd-4bf5-96a1-2a4f00b51999", "value": "E2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435655, "uuid": "86ad6c0e-50bb-4a4e-bc6f-0f645d9d9fec", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435655, "uuid": "8d0d6b4b-1a42-4dea-930e-3c13fee2a738", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435655, "uuid": "78877353-f81f-4e74-8cb9-6a737f677e4e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435655, "uuid": "751beebc-bc2d-4ece-a1b2-8b70b917d1a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435655, "uuid": "62dc3a41-b64d-44ed-9858-9f924bb7e122", "value": "debc6761_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3290f56-b01f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493683, "uuid": "464cbd8d-9779-4157-8b0a-3d42b5881f70", "comment": "Malware payload (Dridex)", "value": "11980631b1cf41b307ebae7b368a792e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493683, "uuid": "cbefaaec-30a5-4840-aa7e-466e5a9c5bcd", "comment": "Malware payload (Dridex)", "value": "ec0701d90f3b5ca2b3e4a30b1a91f06d6236fbd3120900c1df8c92309fc6ba7d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493683, "uuid": "62a9a790-79b4-482b-9ed9-e97f6b43133d", "comment": "Malware payload (Dridex)", "value": "ce368dbbe724de0e59b173fdfffdbe8a4bdb1459", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493683, "uuid": "be96f6c4-5ec7-4bca-a09d-21926bf57bd4", "comment": "Malware payload (Dridex)", "value": "1a5daebc3e36885826aa67b6057a331d0784c68dd3b0436c8621da9de9f2fccdf66a4aaf0a9dda9dc0a825b80aa3a780", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493683, "uuid": "9210f4ec-56e8-48c4-a5e6-01343d0a55f2", "value": "7FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493683, "uuid": "39c46bb3-b853-47e2-8163-ee946198043a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493683, "uuid": "7e031d60-94b4-49c8-be1c-be0356a4471a", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493683, "uuid": "deacacf5-9ea0-4ea8-9af8-9e001187ee1a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493683, "uuid": "3ba49835-f2e8-409c-83b8-2b8d9fd0ebc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493683, "uuid": "3e850e04-c593-4eae-a210-6e456b12ac18", "value": "11980631_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a217a11-afdc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464543, "uuid": "51edc1db-c8e4-4a6d-9253-ed1a70d18d0b", "comment": "Malware payload (Dridex)", "value": "6a010797fed0ef78f3cf01af00d04c75", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464543, "uuid": "083fc351-2e5b-47cd-853c-ed594b1df21f", "comment": "Malware payload (Dridex)", "value": "ec1de23bb32ed217fb0c57e11ec2f48b56a6e3c9f6231a43c7f8f7269b15de8f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464543, "uuid": "f6997134-cfb5-48bb-9d3d-9d4b5954984c", "comment": "Malware payload (Dridex)", "value": "de2c175be5c13094ca54248e76583142b438f918", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464543, "uuid": "f053f4d7-0b93-4e41-9ebe-596b7086b3ba", "comment": "Malware payload (Dridex)", "value": "dfe659ac1df56e384d756d93cabc0685d28d67ab517c91be2735f801a10fdff68cdf2aacb3c5751da853b013a195afb3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464543, "uuid": "c4f172bd-2730-49b1-a564-4cf6e57ab7f3", "value": "2CF3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464543, "uuid": "c8a14e8a-cce4-4ded-9d5e-f5c5a5fdda60", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464543, "uuid": "66533068-aec8-488c-82f0-cfdbcf591225", "value": "3072:6uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:60czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464543, "uuid": "f4f74a64-cba7-4ca6-a538-f751abf33fb4", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464543, "uuid": "0dbefb87-bc03-45b3-81b9-efa595663d73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464543, "uuid": "7db33e1a-8a4c-4614-a79f-18f222e50cd1", "value": "6a010797_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fe6f32-b040-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620507760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507760, "uuid": "17454dc7-ca8c-4024-b590-c9686c7ca5d0", "comment": "Malware payload", "value": "228b42ceb821abc6574286018fe13878", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507760, "uuid": "e9e4961c-b825-44b3-988f-623720bd0c0d", "comment": "Malware payload", "value": "ec4abdfe1c93021362185a5ce6f0f82609ce03a67f4792b1850066d202ae6f98", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507760, "uuid": "dab131fb-9f0b-4ff3-ac6c-f132f3ccf952", "comment": "Malware payload", "value": "4ad51173c931c3c26dc3eb831fcc36fc80ad86fd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620507760, "uuid": "5edf76cd-8b00-425e-a83a-4dac43214d62", "comment": "Malware payload", "value": "87b513c27096e01f2a5657f163b720b2c4b2d06c9d58bea9461ac41beae7cf723236e313132119833548da2b51f2090b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507760, "uuid": "515a3b38-7f2c-49f5-9bb6-858fac7b8418", "value": "B7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507760, "uuid": "51f16ba4-08ea-49f4-9804-fe7ceae9d054", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507760, "uuid": "8d2b2b10-fdb2-4b37-8632-9113f0b45ed1", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620507760, "uuid": "5ba65c24-bd84-43a3-aaa9-cbf9695ec01c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620507760, "uuid": "59470ac8-603a-4415-9cdd-81911319b046", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620507760, "uuid": "74098407-d379-4806-a39a-145562506103", "value": "228b42ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9b8250-afb4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620447612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447612, "uuid": "7156fbdb-3761-46c0-88ba-1b65b31aad65", "comment": "Malware payload (Mirai)", "value": "a9ccd76ed198da82deba8d40a0b112ac", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447612, "uuid": "c4e4e3d6-5ea4-4584-8a5c-3fa270da49db", "comment": "Malware payload (Mirai)", "value": "eca1eed85bfb5d6d882209692d9eaeea8bdf4e0e1e21df7f04363c5cf8a72586", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447612, "uuid": "d14be813-e3ea-4715-8f3b-83e2cc93c6ce", "comment": "Malware payload (Mirai)", "value": "852ae3f02dee0ddaff096320a5d7082e87080209", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447612, "uuid": "fb54a764-c3c4-49d3-a8a4-d6de8f6a8596", "comment": "Malware payload (Mirai)", "value": "0fe2585a404f449d9ae6d3959b04310e7247e6663ff6f65849b805e90f05aef5c6526e85a0ee3d3b875412e9385e675c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447612, "uuid": "607b50c2-f79f-4cb8-9d6a-9cf7b2003843", "value": "0AE2E193B28478279AA21DB1E8FA8085773D536E948E7FBC13500D7DF9EB1680270786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447612, "uuid": "737c5b09-eb5e-4149-99d5-0f619c6e39a0", "value": "768:eBFm97LbJl3J/u5rtMnfWC/jrKBDEa1PEvy7q4wi23UHa99:eBF0bt/uuWOwDf7q3izu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620447612, "uuid": "be25c061-bd02-4899-bab8-293994546ba2", "value": 34128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620447612, "uuid": "6c29b99f-3c3b-4155-952a-bdfe191f3f1f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447612, "uuid": "47d3a88c-8c6f-4778-90bb-22f7944d7290", "value": "ARMV4L(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a999bd-b020-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620493821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493821, "uuid": "d76f6f4a-61ef-43ff-aee6-f04b48c3f0ae", "comment": "Malware payload (Dridex)", "value": "27ee51d0e29779552966fcd1543414d5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493821, "uuid": "13d7790f-31b4-4137-a4e4-13ea2b89ff2c", "comment": "Malware payload (Dridex)", "value": "ecd69c7a3ec7ba181c65c0fb12b1edde62b932219229f3769a91a15ab0a9e7d7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493821, "uuid": "818e595a-2ed8-4e95-9599-89fa792de8af", "comment": "Malware payload (Dridex)", "value": "eb174879266f4d828b7210db8b77bc307514cfd3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493821, "uuid": "83e95ae6-b2f5-4ba5-8604-97f57e6d2266", "comment": "Malware payload (Dridex)", "value": "5392c2fd4e42a6b4672645618dff7e4375d5e024fc7ab5df14d315d9d6b6899de5a798f87f9dc7219c3487b3fd303963", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493821, "uuid": "4cc89c6a-e073-441b-bad7-147b885b4280", "value": "5CF3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493821, "uuid": "82a6d955-08f1-4668-a632-7e7a4f12e613", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493821, "uuid": "5590f829-6f95-4b79-b11e-4a2013c8aac0", "value": "3072:zuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:z0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493821, "uuid": "3bbf543f-9d38-4d19-aa9b-eb402476ac93", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493821, "uuid": "ac611891-5f69-4640-b2d9-493cc8935a1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493821, "uuid": "851f58b8-9c33-42e2-8383-c14ada489ef1", "value": "27ee51d0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5751c672-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "2986248d-1da9-41fe-b34a-cdb6d810a5aa", "comment": "Malware payload (Mirai)", "value": "9545bf0b5b4eaf6d29dfb1adbf58ed97", "object_relation": "md5", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "b280276c-7836-44ca-9050-83b32a0a50ec", "comment": "Malware payload (Mirai)", "value": "ed776a70e2eb9f96d65e7d98cb2ea67c1cc6f4e100530a3f4b3109750f4a8f62", "object_relation": "sha256", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "60fa228a-d703-4d3f-aa23-bd94ac70060b", "comment": "Malware payload (Mirai)", "value": "36192680708568942871d434a4b3a26057bbaffa", "object_relation": "sha1", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "b61f62c5-ec1d-4686-b07e-25dbf00d98ce", "comment": "Malware payload (Mirai)", "value": "5d2ddda9645110cd59f1607f506e8234f81241eeee8a70f9d309ae20f7a33a6aae9987c52d4bffa971721192ca524741", "object_relation": "sha3-384", "Tag": [ { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "aea81a73-58fd-4238-840a-212514a06932", "value": "6C53B80E2E258FBCFB5C863587B79E219648339626E1C185D19CEA015E7034E345FBEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "b4420b0f-7a8c-4c37-8dfa-de3e711397cf", "value": "768:z6dgYU73DIvrH458r45ddiWBhqIoxVf7X2hVD4eWNHZqn1A/NWXW6Dj:ogZ73DIvrdbWBYIovQ4eWNs21QWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475383, "uuid": "af78d62c-e24f-4d10-b5f8-d14dcd9fa824", "value": 63360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475383, "uuid": "6722b5b1-8e88-4190-a939-b909ffde7f8a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "7602cf14-b8bc-4653-ba5c-4164bfa278cd", "value": "Winbox.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae07b6f2-afa9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620442886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442886, "uuid": "b645205b-0197-4528-8c6f-14b58332a6d5", "comment": "Malware payload (Dridex)", "value": "a5a8e2833a2338d58ae897d0972d4417", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442886, "uuid": "44568c85-32a4-4e23-a16a-af20efe18896", "comment": "Malware payload (Dridex)", "value": "ed9fce48e070eb4e56c1049ac4ca531236c1360d7f8a3871adeb27ad5062fea5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442886, "uuid": "b7e64e31-7283-4240-9a48-41738c2e9717", "comment": "Malware payload (Dridex)", "value": "dbc6aedca21e05f71c4b37787903836ec2eac6f5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620442886, "uuid": "9ba1d238-f594-424b-b305-bce279ef4260", "comment": "Malware payload (Dridex)", "value": "433d00de55ec4a2f76b88291ef5a8f5e55711599c33fd3b15d68aa03b465188a4b6cf0b78ef3e19a07fc07a46cf4cb6b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442886, "uuid": "ef1e9305-46d0-4224-abec-ed3af7ade1e7", "value": "01F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442886, "uuid": "24f259e1-1d6c-4aaf-acc6-a83fc08dfd29", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442886, "uuid": "67ab3633-d8c8-4fa9-8bf8-20be9c924349", "value": "3072:tuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:t0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620442886, "uuid": "948c9c7b-11a1-4780-b695-62c24e61b7d3", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620442886, "uuid": "aa43cd34-2eaf-4d6a-9971-a64546a52814", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620442886, "uuid": "0761097d-6df1-4c97-8ca3-f15528c86f72", "value": "a5a8e283_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ec9803-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489636, "uuid": "fd431690-470f-41a8-9bac-8be62e4f68e4", "comment": "Malware payload (Dridex)", "value": "51eba307c630aebda3f8ce18f09236a9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489636, "uuid": "761f8223-aebc-4360-bfc9-a15000172938", "comment": "Malware payload (Dridex)", "value": "edbb52964e771e12cf38204d76542834af6e1fd46767cbb06157394cbfbec46c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489636, "uuid": "08528163-fc09-4dd3-80e9-1f45435207d9", "comment": "Malware payload (Dridex)", "value": "24dd1505e0d73838696a98d0af737bbd1bb697e1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489636, "uuid": "fc7c9568-30e4-4411-95b1-4d188db043d2", "comment": "Malware payload (Dridex)", "value": "dcf859d5d6c3fff6666c9c28c760ccc1ca99cee08bd83c8cc61615676da7d6c9b03081a587e4675b81c68d4aef83d24c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489636, "uuid": "441a3bc8-4a63-41d2-8b5b-1a8f0c11e5a6", "value": "55F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489636, "uuid": "b97d76f8-0300-484a-b232-602dc4a1d13d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489636, "uuid": "2070073f-aa7e-4f35-bc3a-60624dae3e99", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489636, "uuid": "423f96a9-091d-4c49-9278-e25dc00f6581", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489636, "uuid": "557c8c81-e899-421a-a8b7-ec7fac494d88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489636, "uuid": "3d23166d-6280-4b33-a530-fc6d291b56bc", "value": "51eba307_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be87e83-b038-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620504167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504167, "uuid": "be2c30f6-14f0-4019-bc1b-08cbb2d725d4", "comment": "Malware payload", "value": "17a01427782cbdba73cdd959bc47a0ba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504167, "uuid": "6326220c-6ffa-4c25-a54c-1a3aa6864de7", "comment": "Malware payload", "value": "edd34acfbb8ae5db46d8c07fa3d4fe534e2f05df353b67b92fad240b076ea2c3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504167, "uuid": "a2ea4b6d-a9ee-49fe-ba1f-3af0aedb3309", "comment": "Malware payload", "value": "b9079de4e7769d00a55f3fe82f9e097da06a1d69", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504167, "uuid": "944c0c39-ea29-497c-80c8-feef0eaacd51", "comment": "Malware payload", "value": "1b300f3c1f787e7114e3fae3abdecb28359d8d5080628c719fd93b7a5fddb10648484e2dca8161474e9aa84f07d1d615", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504167, "uuid": "d8c2023e-6e98-4a56-848a-eda92e37e9b4", "value": "B3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504167, "uuid": "989a21e2-a5cc-4bce-bf31-0afe108b518f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504167, "uuid": "17de672a-8c5a-4bc7-8914-6b5e42440878", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620504167, "uuid": "9d0251f6-4757-4848-836b-74c6f7f37e54", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620504167, "uuid": "9ef728e7-44f7-45d6-874d-3f7b2c8977f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504167, "uuid": "4de02475-ff4f-45c3-ad94-6b2425e54036", "value": "17a01427_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569a6b17-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "ec13f762-3f21-46c6-9fc7-a0776af7f426", "comment": "Malware payload (Mirai)", "value": "0dd494738a1dac3642731f1ce703848d", "object_relation": "md5", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "ea78be70-7884-43cc-8b76-d8fdc9516e7f", "comment": "Malware payload (Mirai)", "value": "f074f5c963907e8a263bd34a5c0ae6337c59f89add153601d403c2648b63a684", "object_relation": "sha256", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "24a3f834-8aa5-4278-8fa8-50365b0207a9", "comment": "Malware payload (Mirai)", "value": "d04dd58afcf84b12624a925ffa278d11d30fc910", "object_relation": "sha1", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475381, "uuid": "e59b9cee-073d-4a40-9d3f-05e2cc1169c8", "comment": "Malware payload (Mirai)", "value": "b13648dca529a62227aacaac586d2a7e6d5635c255117372e0782b7b08f655a3f7be2440545ba27d97723fc975b8ca83", "object_relation": "sha3-384", "Tag": [ { "name": "arm5", "colour": "#C2EE0C", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "09f328a2-6401-4707-a786-b104620186f5", "value": "9013E792B8929A26C6E4237AFAAE518D3320B7E8D1DF3217CC211F4477C961F0DA7751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "666e98a2-4722-4c88-894f-711c823ed812", "value": "768:xp/lVgbigbL3OJ7HL3UOXrQJJSagaUuxR43qCE3NhlJPy67rBCM/ECks3u/PN:xO+gWNr3HaU2R46CE3flJ9CM/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475381, "uuid": "bbdf8ceb-5c2e-41a5-91f9-c13fa7685e7f", "value": 42188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475381, "uuid": "33ef94f2-e9fa-4378-9580-42f8ef596942", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475381, "uuid": "80768781-ab66-4cec-acc4-9b4852f13c4b", "value": "Winbox.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273030df-afca-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1620456834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456834, "uuid": "d9468a3d-4744-4d52-b0e7-137f95ed8ccd", "comment": "Malware payload (RaccoonStealer)", "value": "34d8fd324a2531af7dfc714984c991cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456834, "uuid": "08471e7d-4c67-47f7-bf38-6238e1deada6", "comment": "Malware payload (RaccoonStealer)", "value": "f0cda71528dfdf5b3fbc8af58a61aef5f9d6432c0359ab8d9df62209e6ce6d01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456834, "uuid": "ae60a751-47e7-4c0e-a8fe-4eafb7cdc7ce", "comment": "Malware payload (RaccoonStealer)", "value": "4b3842146c947fd23b79d1cce0f56aeb4b2fcbec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620456834, "uuid": "beeff608-c8f0-433b-9da7-dbd781895f02", "comment": "Malware payload (RaccoonStealer)", "value": "e298795363b77c1dc35e5ec81122d3466a46cf2744d10c704cada62d37e18372d8880ca619a690a1914365cbc86af1b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456834, "uuid": "65c0caef-88f1-4349-b8de-5bb4f64a41ee", "value": "7F1501117480C172DC5A1EBA4011DB759EABBC325F214FCBAACD2779EF207E1BA25349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456834, "uuid": "687c1c9b-6cfc-4386-84a9-e58d47e83052", "value": "e5eddde3bc28318303bde004dece8436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456834, "uuid": "7b8baab9-2214-4970-92a9-23373a60f933", "value": "24576:c4dwvZbwsA9u/aX9E4VMt+XF4bik27LJU/jE0U:WZbwsVi3F3k8y40U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620456834, "uuid": "8d4b878a-02e0-420c-b6e9-b45aef3e5dbc", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620456834, "uuid": "8817acac-e670-47d0-8c2d-d1c322ee4686", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620456834, "uuid": "f01667ca-8c4e-4150-a37d-88d47925a0dc", "value": "34d8fd324a2531af7dfc714984c991cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3af7f9-b027-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620497059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497059, "uuid": "b61b1276-f8b2-4963-8b7b-a5207f5b1a60", "comment": "Malware payload", "value": "138de3221983b08e6fcd6439bb68b132", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497059, "uuid": "bda1e6e2-e1ad-4e71-8a33-9b4e57a4c2b2", "comment": "Malware payload", "value": "f0f8a8277bc707dc80150ec334db52bc3ce1444a01a9171d959f98439fb06d36", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497059, "uuid": "6cf31345-2bde-4ab2-a518-8efb24c7e519", "comment": "Malware payload", "value": "528c94b7da3a119d3f90718c69b07f08827c7568", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620497059, "uuid": "f03f76be-317b-48e0-8f5a-57fdcaa8cd99", "comment": "Malware payload", "value": "5c289a5a741eff2329c0ac83f558c98c5f8c3cce4b4c77a4332380f09e4eaf34227442754b8fe918813cbe6e961791a3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497059, "uuid": "869d634d-eb91-4e25-aa10-98f36e924423", "value": "49F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497059, "uuid": "044c1eca-6c89-44a4-a287-fa4365135781", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497059, "uuid": "7ff7b204-4a20-4ca1-bc5a-34cf7362f7b0", "value": "3072:YIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Rc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620497059, "uuid": "f8c5279c-bfe6-44ad-a7c7-6d89b10c7161", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620497059, "uuid": "26b12743-a7d3-47ba-9fd4-90c1ebc7c9d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620497059, "uuid": "96eaa50b-a334-4c77-b8c6-2fd84c1475be", "value": "138de322_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf8ded8-afd7-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620462615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462615, "uuid": "3d97ee9e-1169-4f84-bbb6-f2e86b361828", "comment": "Malware payload (TrickBot)", "value": "fa4177d1b5ad0cd12396b2ef1ca991d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462615, "uuid": "edb0b21b-0da6-4b15-80a7-874b0839ca6b", "comment": "Malware payload (TrickBot)", "value": "f17f19350c6dbcf733c1d2fed10e8c853ac3af5117e8dc8122f06c87bd41d19f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462615, "uuid": "2defa791-ed02-4ade-9a02-fa32eebfe0f6", "comment": "Malware payload (TrickBot)", "value": "608436f7b914354215bc2ac31e090e8878eaaf64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462615, "uuid": "299f43f0-d3c2-4ebd-aced-79d4d31ef6ec", "comment": "Malware payload (TrickBot)", "value": "e7d5693c31d8593cbbf8f6ca2a2d0c2b56e04dacac8d0600325a8263055db4dbb4fa263670303aa516e2ba3e74c8f91c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462615, "uuid": "9ba87523-beb3-42df-8b8f-37f11d1cb400", "value": "87F4BE02B2D1C177FAF202714FEAAEF7EAF5F9114A295447F3D62B0D19719434A36A20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462615, "uuid": "3c911016-0486-4b64-bc2b-92d9d54c49d5", "value": "a854f0696e579de7373340a712e95c97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462615, "uuid": "bc0d72fb-5bab-45d0-b4db-0acf8bce4416", "value": "12288:bZfAStuSnRmDuGQ9bNfvzn04ueQlzxE30wIpgfCORMxVB:h5RmKNfb04ueQhuEZifCqMxVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620462615, "uuid": "99d9da64-81ac-419e-8b17-f49d1040022b", "value": 757828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620462615, "uuid": "2c83fd3e-5960-413f-8305-a051a5be0f51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462615, "uuid": "aeaf6171-c25e-4f16-b8c4-ab80f83c5faa", "value": "fa4177d1b5ad0cd12396b2ef1ca991d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c473d816-b048-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620511214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511214, "uuid": "5b1e1094-5da9-403a-8bcd-a775b1126977", "comment": "Malware payload (NanoCore)", "value": "40fef8000002ff8b153914c69623f808", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511214, "uuid": "43687a9d-87ef-461f-88ee-bfdba3295eaf", "comment": "Malware payload (NanoCore)", "value": "f1a5fbd3e946e8db1c18bd1d30d0f8b41a873cbb76769557e7dcde3074511c10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511214, "uuid": "c9f60a13-2ba1-4ad8-9a7d-ea88970ade7e", "comment": "Malware payload (NanoCore)", "value": "12da9a73186bc60567f1f3ad90ea52fc80652032", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620511214, "uuid": "4dec7915-4f7e-4d84-a116-4127f3a9dd40", "comment": "Malware payload (NanoCore)", "value": "a8ba1bc0593ec1796ab9b5437e8b7b35e6b88f09951b79ee5cfc7108a8e38e1339cf234c1c0afeeee1d7dcfe649aab39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511214, "uuid": "458b0a0d-9c06-43ee-93e0-5f576557edee", "value": "8836530DBCA6F4211BF76E7BF2329402F9036424CFFE752912FB548A625E52DF820569", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511214, "uuid": "d35551af-5e5d-4ad4-9242-67eddae7bdad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511214, "uuid": "dc738fe2-61e4-4597-9eb2-40ee57255eb6", "value": "6144:RV9XaKzdh4yFMkzRfrMzPzNztzyN1zi9zXzCEGvfzv6mkMzYZsztzZkzNwE78ahi:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620511214, "uuid": "ca949198-a751-41b8-8ce6-702537f5863b", "value": 4984080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620511214, "uuid": "7b84c79d-5d43-4312-99ca-2a5c047b2c6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620511214, "uuid": "d2d55b27-d3ca-45e5-aa7c-363d6c95f843", "value": "f1a5fbd3e946e8db1c18bd1d30d0f8b41a873cbb76769.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26d9b83-afb1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446437, "uuid": "defbf385-3cd2-4432-9722-89d082e06e4e", "comment": "Malware payload (Dridex)", "value": "d521d5f7fabb2f90b4f42bdefccc6fd3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446437, "uuid": "2add649b-8e4c-4572-b03d-450b073fd1cf", "comment": "Malware payload (Dridex)", "value": "f1a973cefb7010c531516cb38feba0db83e058f83e5d343d5ba4672375fd8926", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446437, "uuid": "77c6758b-6184-4965-9d22-31f1bfbd191b", "comment": "Malware payload (Dridex)", "value": "1ab0b929a94124e88e082ad908f2734a7f4c4a6c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446437, "uuid": "b6708e35-673d-4cb2-b413-0cbba3cdd3d8", "comment": "Malware payload (Dridex)", "value": "5de890e96eca869d50447a66619e95122cff7a005f145b03ff6a2dd7b34f099a6aa9328fedb6cc7b43b41e98c6c631cf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446437, "uuid": "96425ad6-4081-4fd0-aedd-277dc0feda46", "value": "7EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446437, "uuid": "9679734c-06fd-4e6a-9340-ed8763c1bad7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446437, "uuid": "2def027e-7308-42d3-a003-60a46d51a15c", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446437, "uuid": "36cd398d-f0d4-4ed3-96dc-ea1da7a88007", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446437, "uuid": "216063c9-0599-4c4d-be66-41449840ef00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446437, "uuid": "8fd4f140-c8cc-4bdf-bf7c-8a8b18c5426e", "value": "d521d5f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca6582bd-af98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620435633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435633, "uuid": "c2cbade2-ab76-4271-92af-0559d9982908", "comment": "Malware payload (Dridex)", "value": "d8b393256ec9a4e10cbba5dfae5ece18", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435633, "uuid": "921ad5e6-8bea-45cf-9b79-e443bd553d55", "comment": "Malware payload (Dridex)", "value": "f1b9d27e66565faca0858f91bfd331103a6b4e3fc8aa3d86191ea27d47ae6e6e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435633, "uuid": "9bd040b5-12cc-41eb-8abf-fdd184638305", "comment": "Malware payload (Dridex)", "value": "fa6c329aff7a4dfcb7d650122e59c780f5b59b09", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620435633, "uuid": "f1c505f7-3fd6-4197-8e1e-ee55646ca918", "comment": "Malware payload (Dridex)", "value": "f4afdc1bff2ac741182b9c5ab8e81616dfe0dce98546c5c796fbc750bd8358d28f7fa965f4fabd3a8948f10ba18de1ca", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435633, "uuid": "29c76e61-5a5c-4e92-9b95-52b5e7b6eb65", "value": "6BF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435633, "uuid": "fc431f28-a7a6-4322-bf39-8a3fe650370e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435633, "uuid": "1efdea45-a727-4607-9c64-609f9f327028", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620435633, "uuid": "f4068fe6-8900-4d1e-991f-986e574175f7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620435633, "uuid": "b73fd898-7766-49b9-8481-fd645965717d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620435633, "uuid": "02be6a72-48ef-400b-ae92-33ce182d3729", "value": "d8b39325_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07fb890-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471640, "uuid": "53efe699-f6c3-4daa-9db2-5fabec0d107e", "comment": "Malware payload (Dridex)", "value": "b633a2d01db517f1ae9bbde2f717b9d7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471640, "uuid": "cd811684-4381-478a-9926-d4f87c72e1e3", "comment": "Malware payload (Dridex)", "value": "f1febebd34250dfc683037a784f3d66afa3b9555aab48db879e528b4194e5c62", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471640, "uuid": "188a70dc-7a25-45e2-b089-bb570755f0c1", "comment": "Malware payload (Dridex)", "value": "32e9f5a3a6ba9e143c9ac242c7b4d2b0db8b92d4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471640, "uuid": "4044a942-a9f4-4a9d-a42a-bf6f1388eb24", "comment": "Malware payload (Dridex)", "value": "2761fb7dca81dfce515b7fb0267e9dfccb5b64f5b025f73fca0548495164a79e48aea80c24b84b0338307e705bb3c9a8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471640, "uuid": "1833b1e7-170d-4054-8f3b-881c97559357", "value": "5DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471640, "uuid": "aea700ba-1d96-4bec-9e71-59f3a87867f6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471640, "uuid": "5ab07251-1ca2-4b48-af8d-17e4e4f8db58", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471640, "uuid": "b1cdb1b5-e436-4ff3-9678-eef6aef33018", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471640, "uuid": "d527ed21-c934-4e1f-a6fe-db587f989d47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471640, "uuid": "c90268da-f726-47b2-bb8c-b8e8b6b3ef71", "value": "b633a2d0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed863389-b051-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620515148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515148, "uuid": "4681e629-df83-409d-a8a6-5fa226e2954f", "comment": "Malware payload", "value": "a5c845665d0dc796b599ec01481014e2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515148, "uuid": "cff3512f-1538-43c0-9b8b-93ef99eca222", "comment": "Malware payload", "value": "f28200916db1e0ba347cb1a3aa95960a4a4ef55446cc0253eabc21c6d98df676", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515148, "uuid": "8afb2e01-521d-4bf5-8b93-8091b09dca70", "comment": "Malware payload", "value": "25795f031c7aa8776ed61d84a46cde02d064a527", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620515148, "uuid": "8ff24a31-a5eb-4c36-bfe7-1f34572b2805", "comment": "Malware payload", "value": "076b60f894360e57132ee3c722929c109ad50db2f7226f1865d5a6e5085334af7d68c9eb26e2108485c091e2ee7113ac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515148, "uuid": "a882923e-3ed3-4334-adf2-52b4fd7b55c7", "value": "02F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515148, "uuid": "4b2c40b9-5b5b-4d5a-8f1c-38463c60e4ad", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515148, "uuid": "7d1448d9-fa53-4f77-94c6-584a36e4fefc", "value": "3072:/lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:/lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620515148, "uuid": "65bcf571-f3e8-47d5-ad71-e64421efcf34", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620515148, "uuid": "3f7de05e-cd92-4661-9a91-064c8cbb0ad6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620515148, "uuid": "aa05b355-8b81-4163-8799-ffd664487596", "value": "a5c84566_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177f0d05-b00b-11eb-abe1-42010a9c0039", "comment": "Malware payload (DCRat)", "timestamp": 1620484725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620484725, "uuid": "c64092d6-acf0-48f7-99e9-3ceb16abf776", "comment": "Malware payload (DCRat)", "value": "c490e28c498b96ad1dc7025104843858", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620484725, "uuid": "6206cd7a-a1a4-47e8-a75a-d23fcbc56003", "comment": "Malware payload (DCRat)", "value": "f35d290dd97ec9018f85d43c6fe49ccb3214e9f6bb8bb321fd8f40fb4a896a68", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620484725, "uuid": "134e7d56-540d-4eba-b5a5-0a13ba887a27", "comment": "Malware payload (DCRat)", "value": "a7a4c7c471d3dae41f2d2417585056439df417fe", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620484725, "uuid": "ed11c35d-ba83-4dd4-9d86-067993d06768", "comment": "Malware payload (DCRat)", "value": "d30ab89a1466b64fef6896d2c96b46ee580782d95c463c1efa2ceac0243e6355f0d70a3f9a8a55b7e089efd9512ea385", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620484725, "uuid": "f70c51bb-4d8c-4308-b97f-e616f208af8a", "value": "2A256C237644CD11C0B91636EDEF85540BBCED042A62EBAB7F9A326C64533E35D0E1DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620484725, "uuid": "b981ca2f-cbd6-4fd6-8fcc-593b267e2e5e", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620484725, "uuid": "e69408d7-f5c5-4f8a-8e66-79b6876d3db5", "value": "12288:aRZ+IoG/n9IQxW3OBsee2X+t4Rbve6XJCeNRvGGxT/KBjF3Wac/FVsq8ophoRdfE:U2G/nvxW3Ww0tve67NVT/KrGausqyK+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620484725, "uuid": "0b8314d7-b9bf-4aa0-986e-be1c37095ed9", "value": 973460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620484725, "uuid": "79355c0a-0e71-4906-8e65-d086b85f8d62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620484725, "uuid": "3ae195d5-a986-4b2b-a3e8-e564677ab4d8", "value": "dcratbuild.exe.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041952dd-b006-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482544, "uuid": "00738059-2c9d-450c-9fdf-da5d8af1dc71", "comment": "Malware payload (Dridex)", "value": "1c76e2a93ee0aa269822d12edea760fd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482544, "uuid": "76439cb7-42e8-4968-a40a-2c1294786080", "comment": "Malware payload (Dridex)", "value": "f360c8145ea22196de32741c9431cdd558d79261f34f081a70533549d1c86c4e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482544, "uuid": "7cc86f7e-63a3-4a69-9bb0-715e389d4b75", "comment": "Malware payload (Dridex)", "value": "75e4953ec1a42aed2f9beda59679ab058c3b9a98", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482544, "uuid": "0a67e72a-b77c-4dd3-8115-d723235f0732", "comment": "Malware payload (Dridex)", "value": "0be0c21b6a58b9992ad787239f9be530d5376a5fdce3a6574ca65005cab46cc09289d78d498d7b3edd18b050561be76e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482544, "uuid": "13383686-67c0-4543-8fdd-296a26b83145", "value": "97F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482544, "uuid": "95d1de42-90ac-4bd2-83ce-b42f74a9343a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482544, "uuid": "d27c476c-c84a-4bc7-97e6-6618dfd1a784", "value": "3072:1iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:eeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482544, "uuid": "6dc8c027-566b-464c-89c4-57dfdf9eedcd", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482544, "uuid": "dff6f749-36ba-41ea-a5f6-7d1073157f09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482544, "uuid": "68b61f2e-2b24-4a33-a7e6-e285baed0b0c", "value": "1c76e2a9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bedaf9ed-afb4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620447639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447639, "uuid": "7b78c799-62e2-498f-a964-fe3f818f13c4", "comment": "Malware payload (Mirai)", "value": "c4ae58f2c7567caace9fa7d23607e2af", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447639, "uuid": "4c5e63d4-d91d-48ff-9b39-abb7b034ac15", "comment": "Malware payload (Mirai)", "value": "f47d7bb060cc28e23cf48cc0877418549de027a4407d1ae32d5f0b6ec30259b8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447639, "uuid": "3f693886-aab1-4118-9ab7-0cfac8e80529", "comment": "Malware payload (Mirai)", "value": "4b49abe3080fc5e4b920580aa6365fb9b64e6acb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620447639, "uuid": "3a95fa8a-0725-4aa8-89d4-41194eaf32e1", "comment": "Malware payload (Mirai)", "value": "1ef4d123177dc18cd37c435156c2357dacf63e5eb7036bf2597e428fecdabd85da45755b727044f9662a77ac4e355ce3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447639, "uuid": "5d9dd0ca-b1ba-4e15-a08a-86fd9ec45e7c", "value": "14C34C46EB408A13C4D51776BADF424A3323E755D3DB33068918AFB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447639, "uuid": "2e3a8960-f1cd-4236-a52d-1be1d9063e14", "value": "3072:2KhtbMTCtzt6O92CZsZweQJWG3k+amQxVVdVSz:2KMTWztZ2CZsZwLJU+amQxVsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620447639, "uuid": "8381dd01-ead8-46ca-9fc6-a53f0d50b264", "value": 125754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620447639, "uuid": "8dedc9c8-426e-445c-b9ee-5dd7ac46a257", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620447639, "uuid": "a46c65d4-9787-423a-b95a-f091c7578cb3", "value": "badpackets.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b5a0e9-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478974, "uuid": "c1ff473d-1dd2-4902-870c-f34862b435de", "comment": "Malware payload (Dridex)", "value": "ec95e03b76d46e3530692173e5e68350", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478974, "uuid": "30fbf6c9-42b1-4a1e-8c59-e8ad971c1675", "comment": "Malware payload (Dridex)", "value": "f4827fbdb216b9f7ffae9eb5f864323d063ef619f072478fddc1859b26f4fa65", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478974, "uuid": "e7e2ad48-aab6-4c74-ab05-1822791d93e9", "comment": "Malware payload (Dridex)", "value": "21922c82548c989c5a2729955262b7b385bbb8cf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478974, "uuid": "61cd124d-deb0-4c80-9cfa-f4a043277d87", "comment": "Malware payload (Dridex)", "value": "a88518fb0b7473b9568ff0665b014ef3b783fdf5fd11f6305e41797cd79a485caa6799e5f5b077839211658eb11ee3c5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478974, "uuid": "01e5ddb9-31ed-4b66-ab22-0a28a4ae8553", "value": "EBF3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478974, "uuid": "837fdaab-d9e8-414b-8987-38d66269ee97", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478974, "uuid": "a40db8a8-a94b-4807-9c55-88046c106ece", "value": "3072:yuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:y0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478974, "uuid": "9bdbc01d-eaee-4339-be34-d8f3bfeb5727", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478974, "uuid": "ff2d2269-e3bf-41d2-bf28-b9a235856480", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478974, "uuid": "bfeae5c3-4fbc-4a66-9e5f-6b559b0be428", "value": "ec95e03b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9107e226-b016-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620489653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489653, "uuid": "b5d0d9ae-29a6-49d8-bb74-b258bcf31be5", "comment": "Malware payload (Dridex)", "value": "9158288676d24c2c0e9339e15900f8bd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489653, "uuid": "909d3db4-1276-4451-8843-01518f8add74", "comment": "Malware payload (Dridex)", "value": "f53fdbf399cf452d7204ea5dd3bc52ba4c147f88d0b6fd2f3a7f2cb90c65318f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489653, "uuid": "debfa93e-dcfb-4c64-a9fd-78ae2c887a9c", "comment": "Malware payload (Dridex)", "value": "e972b654eb5950479c4ecba92b06e5d79a39b01d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620489653, "uuid": "e99831fb-7272-49d5-aaf3-491b6d7db25c", "comment": "Malware payload (Dridex)", "value": "942994d22e7b1f300f2f35b354d58bfbc4029fb1415fae4a61349e3404ec64b06f4272f98a65398974f07c145abbb103", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489653, "uuid": "adb56fc5-1ac0-4758-bfc6-19c7a466a48f", "value": "BDF3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489653, "uuid": "39730f97-57d5-4215-96c1-ffa5d372b816", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489653, "uuid": "0efbb57a-105a-4c62-b25b-8165333305dd", "value": "3072:3WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:342IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620489653, "uuid": "8aab4d3d-0a98-43d9-9470-dab23f36795f", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620489653, "uuid": "739c3143-eea1-406c-aee4-b8ff80d842ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620489653, "uuid": "7e41609f-32f8-488b-a60b-2083be10b034", "value": "91582886_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2977de3f-b00e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620486043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486043, "uuid": "7668a11b-8a99-47ba-a4ed-b1d926328878", "comment": "Malware payload (Dridex)", "value": "b42d12989e13ea95a2f1b88735926da3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486043, "uuid": "6944c47f-5ec3-40f7-aa10-25138ced772b", "comment": "Malware payload (Dridex)", "value": "f549cbc536f3b05997ac1cc634f48e3b35dc7a8eaec6d8758a3b009957db6f46", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486043, "uuid": "6fb2c795-7ede-4b40-81ac-eef60d3cd588", "comment": "Malware payload (Dridex)", "value": "e68a6ce68a4865334abc722fc05f3f0ff9dfb7a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620486043, "uuid": "91fed38a-9df9-41be-9e5d-2c2d6e908998", "comment": "Malware payload (Dridex)", "value": "39e0945956cc3581cfef231bb2c6b3f5ff10a0d0a8d0e18c3c9c4fe95ee850c715e537905152af8ed7fb8fe459f82250", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486043, "uuid": "5209c227-e54b-4c2d-a196-2d0981db48ff", "value": "39F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486043, "uuid": "b99211d4-a4fe-4072-83e5-54e4bd0573e2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486043, "uuid": "7dbbc22a-1da1-4386-9276-d97a66de7a32", "value": "3072:wKmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wbLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620486043, "uuid": "0e3c956d-4c5f-4dfc-8580-aeb2c3f8d659", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620486043, "uuid": "29c98d32-b29f-469a-b958-5eb8635cecf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620486043, "uuid": "1bb0ba16-a234-4ed2-8091-fc3fb63afd65", "value": "b42d1298_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af341405-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471665, "uuid": "d307c373-fc54-4e62-9009-3dd2cc019af3", "comment": "Malware payload (Dridex)", "value": "ed977a0bafb0ca7ecc260094b797cf6e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471665, "uuid": "b7282040-51e8-48d8-ac3f-30c624b773b7", "comment": "Malware payload (Dridex)", "value": "f62d53e6f92b3c99b20c141e51a82a7b67a725e1a702b79b96ffee18cd1668c7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471665, "uuid": "f8166c57-ac2b-4907-84ef-fff10172338d", "comment": "Malware payload (Dridex)", "value": "29c78eca9df486f3e1caa4b1711654d852027ab5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471665, "uuid": "fd68ff84-725d-4e0c-85c1-5f379c576974", "comment": "Malware payload (Dridex)", "value": "0d1c218b124d1bfccfd94493e12e090af174dbafc5b48a802796ebc1eb7305959ad828eae83f1001f730fb241cecf176", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471665, "uuid": "9762f7e6-df5f-498b-b9f0-58a44331aadc", "value": "F0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471665, "uuid": "eb18cad8-c281-482b-8756-a70dbb858c34", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471665, "uuid": "dd39dff0-0ebf-4059-9e97-931bf74adf66", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471665, "uuid": "59ceae24-383e-484c-9b9e-d22d2455f60b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471665, "uuid": "a332fd33-563d-4034-b48a-56202ed08d0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471665, "uuid": "7378483c-cd89-4554-a5f0-08cb4adf4fff", "value": "ed977a0b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4d2f58-afa1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620439236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439236, "uuid": "11604af3-a5ae-42da-b438-fb69fd162c4d", "comment": "Malware payload (Dridex)", "value": "87580967236a10d9875d86e42309d857", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439236, "uuid": "447bdf26-33de-4ea8-9776-7cd112d1ec63", "comment": "Malware payload (Dridex)", "value": "f704ce1f87f662f16ad704f18f7f83dd594f88ed27bacbed62fb68f2ecaa38fa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439236, "uuid": "3162db26-5528-45b8-9aa6-607a4f16bf73", "comment": "Malware payload (Dridex)", "value": "99dea824e8f109b6cf12d2d728e188095140a822", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620439236, "uuid": "d3a7a057-5bc1-4807-9ff5-369dc1ab99d1", "comment": "Malware payload (Dridex)", "value": "19b838f07623bf151a0472ccd2e5ddfda9fa34a764c18190518d47fbe54b9c9be0190c28a7e983281b88e6370b843fd9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439236, "uuid": "9c19d370-6b1b-495b-833b-04c38bce0403", "value": "EFF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439236, "uuid": "c9178b29-3534-4d3c-bb2b-8eec9f1c1283", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439236, "uuid": "3131fd9b-9d65-4843-b874-41277aa5dbf0", "value": "3072:WiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:NeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620439236, "uuid": "9706f781-89d2-4d75-86d8-0891b7bb2250", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620439236, "uuid": "a41d9013-ee55-4507-92e5-f491e2096451", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620439236, "uuid": "e2b39ac6-ea13-44d7-b9f9-8f299e68da49", "value": "87580967_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93c39b0-b005-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482526, "uuid": "42b591c0-1ed0-4a33-a939-97d83bbabc3d", "comment": "Malware payload (Dridex)", "value": "12139607df69836a7fe8f587000ab0bd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482526, "uuid": "1c8e341d-294e-498c-8f20-715c2840cb10", "comment": "Malware payload (Dridex)", "value": "f7431a2a807328c6d66dae7fb2cf098e0ffd28b8b396112c8d89c873830beb26", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482526, "uuid": "9bf23c8b-a39e-40bc-b31a-2485a0178c3c", "comment": "Malware payload (Dridex)", "value": "68a4ea43a3b151da2fb3fa089199ca0660416a36", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482526, "uuid": "7e63fa61-d7a0-4b22-a1b4-d74c694978d2", "comment": "Malware payload (Dridex)", "value": "a018927186449fd128f00ca92508df6428edf3147437bb52a8673ed876dea95aab628b43f3b5d66c19bd7d42a25bd279", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482526, "uuid": "2b28a64d-81b5-41f0-a317-0b4ad40c2ef7", "value": "CCF3D081E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482526, "uuid": "9944c430-f833-4f8f-b3a4-179a19ce19e2", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482526, "uuid": "86ee55c5-8b68-419f-96b7-4d4042513dd5", "value": "3072:aBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eH2H:quXLcclWEc2HeSjNjGdeWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482526, "uuid": "cc5b86fc-0c8f-4526-9dd8-234f5c7eb8a0", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482526, "uuid": "99e7da65-6882-43a7-83c6-38229397b8e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482526, "uuid": "40c89065-55fd-4038-a9fa-89ee76455416", "value": "12139607_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750981e7-b01e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620493042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493042, "uuid": "ac6a12d2-4be8-448e-8050-d771a6c1321d", "comment": "Malware payload", "value": "59b91d3f973a76b2cadd0c015eea755e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493042, "uuid": "0eeb9931-b85b-4ab8-b4dd-4eb4c239e6ef", "comment": "Malware payload", "value": "f7c14b31287077767f6c64fad68fabe53a78273ed4cf303c041357d66675bab2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493042, "uuid": "797667e2-6555-48de-b217-0bc09406c442", "comment": "Malware payload", "value": "3c646df0f8063d2f7ca9fc32bdecf05053faff39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620493042, "uuid": "1bdca1bf-8327-4855-9a75-83c05bc2adeb", "comment": "Malware payload", "value": "0d9222c08f2806330a4e2ebfd62ee58998a00cd9d122968bd8e9a1060d0ec41b444a084e3930bf7bc6e1c0983326a697", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493042, "uuid": "22a24631-00ce-4ce3-806f-7480f5764ddb", "value": "CE92080DB3ED4705C0BE9A7F4EB2465043B6A9435A32E64F0EE954AF1977B408F24B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493042, "uuid": "6da29dac-3fd2-449a-b0c6-0fa031cf562c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493042, "uuid": "5addb404-2f15-4041-b270-b09fded4a4cf", "value": "384:+0sGnv7vTJth+2Vwd9CsSDFMIMsouajXayewPw1zhkhM3t:+Cjvfhzwd9IDFOeY2hkhM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620493042, "uuid": "95d80059-2f93-4b69-b948-263c4a50bab0", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620493042, "uuid": "aa68cec2-4949-45a1-95a9-ea47a5d83fa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620493042, "uuid": "799309e1-d789-4635-a4f1-40e7a5026d54", "value": "ml.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e4d514-b038-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620504284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504284, "uuid": "b9f01f8a-d214-49bf-b912-f44a916f444c", "comment": "Malware payload", "value": "40c6af141f09b8aea798517411042a81", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504284, "uuid": "88dd26be-c2cb-4104-b5d8-0b37036a6c55", "comment": "Malware payload", "value": "f7fdaf8c6a183f3459ba0b0859483171e80b252e58441c166485809e8479a0ee", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504284, "uuid": "db5e5a21-f887-4bfb-a737-df7a8f197573", "comment": "Malware payload", "value": "caa06f4a94089f1fc2dcb320c92cf27f6e61e5d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504284, "uuid": "99183e8c-6ecd-40ed-b6ca-e97b1c0333d6", "comment": "Malware payload", "value": "37d55d97085c418e63182f89e8ad8eacebbbda657c029b879b810caa0956001ba7188ca7c2209f4f78bb3d1d71cfe39d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504284, "uuid": "7c62fbce-b1ed-4c42-ad46-780b873a611a", "value": "E9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504284, "uuid": "8832289d-7e69-4519-bc92-e510263e6c6f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504284, "uuid": "2f101552-058c-4bf8-a22a-1fd156803b1f", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620504284, "uuid": "14a13cf3-051b-4477-9cba-4af0fc0d18eb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620504284, "uuid": "e2fc4740-6192-4884-95ff-f157e6c2cde4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504284, "uuid": "15879d13-ff69-4c0e-99bd-f6057be85f0b", "value": "40c6af14_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32d56e7-afca-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620457176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457176, "uuid": "857c4270-83d9-4cd8-a9b9-904e953df338", "comment": "Malware payload (TrickBot)", "value": "96c0510d34060e7b74c20b910baf2b62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457176, "uuid": "a7239039-c4b5-46e1-9379-d0b4fb736546", "comment": "Malware payload (TrickBot)", "value": "f90aeb669c32ed6f1009101cc3c071a840f25c7828035601e92f4e17cd95b606", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457176, "uuid": "2979751c-abf4-4f81-a7ad-0fbe46808ce7", "comment": "Malware payload (TrickBot)", "value": "1fb3859948022451d9f8a7c83d154205692b6485", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457176, "uuid": "18e55396-aa93-480d-8655-d7f24ebefe03", "comment": "Malware payload (TrickBot)", "value": "3f84de93942b4ee86567bd1311e65991c3715e7b38e6af44c5d555dc08b202afa278bb3a9c30b3c0ae6570207ab494ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457176, "uuid": "483c1505-2724-41b5-99ac-e01d6a3ad276", "value": "EEF4BE02B2D1C177FAE202714FEAAEF7EAF5F9114A295447F3D62B0D19719434A36A20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457176, "uuid": "d016b8e5-3e08-4f35-97df-7ac1cb8b7396", "value": "a854f0696e579de7373340a712e95c97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457176, "uuid": "4642f654-3832-48b3-85ad-618021bc7fc1", "value": "12288:bZfAStuSnRmDuGQ9bNfvzX04ueQlzxE30wIpgfCORMxVB:h5RmKNfbk4ueQhuEZifCqMxVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457176, "uuid": "3c387ad3-d4e8-44b8-8784-3782ab8e2c94", "value": 757828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457176, "uuid": "ea67ec23-2bd9-4a2b-9948-abbabf3652e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457176, "uuid": "861061e5-fb37-493f-af74-860ce17e1e9b", "value": "96c0510d34060e7b74c20b910baf2b62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b36a69d-afb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446479, "uuid": "4bf91c8d-c9e1-48d8-a008-02725d30a2d3", "comment": "Malware payload (Dridex)", "value": "6351acecf5e85ba2c976b8a213335769", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446479, "uuid": "9614b002-229f-4ee1-8dda-fdb75bacb91d", "comment": "Malware payload (Dridex)", "value": "f963cf18142c1502ec181f61b9e8b679de8aca6a54e245f6ddda29858c4135ef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446479, "uuid": "f437cbf4-a9d8-4c3f-bfd1-aca13709eb13", "comment": "Malware payload (Dridex)", "value": "ace0f06e1667ecc126b66b8c659fccf6c376a1ab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446479, "uuid": "53af0810-63e3-4135-b828-0d426a1527cc", "comment": "Malware payload (Dridex)", "value": "9be4fa6a20cea0fbc5cada7e113cf672196b710d051e12df992bd55882820c04c4a4e8e6edc6f27721f8e43fef0c767c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446479, "uuid": "504e7905-008b-4974-8f8f-343788dfb70a", "value": "55F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446479, "uuid": "2ae79de1-2fe1-406a-bbcf-28aedbcdb149", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446479, "uuid": "f675aca1-e54f-463c-8dd8-585b327d1684", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446479, "uuid": "ed192605-3882-468a-82f1-60356d08c14a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446479, "uuid": "afb8e6e3-b94d-4207-82f8-0247921a8238", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446479, "uuid": "3e468d0c-38bf-46d6-8089-fdfc549bd8c4", "value": "6351acec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93a8d97-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460917, "uuid": "90b49ef3-43e3-4310-b380-340dfaa0b1ce", "comment": "Malware payload (Dridex)", "value": "2f41824648b055632e1acb9f275a50dc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460917, "uuid": "76a18713-9812-48de-8630-ba6c46c298c8", "comment": "Malware payload (Dridex)", "value": "f9894a37c2f7803ffea5f2eb9935e9cc0bb544480ddef0a9167730230a9e0de2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460917, "uuid": "1fdd2907-3564-4949-a443-5daede6d7a85", "comment": "Malware payload (Dridex)", "value": "818875b48f83e99114daf99b1bb7366ee2b6db43", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460917, "uuid": "93bced36-7bfb-459e-8520-26840176b4dc", "comment": "Malware payload (Dridex)", "value": "60b90b16fa23e4a45507bb2ca39a1430a2969d79991fdef194b20d76c2de4e83979376e4f255d88717e48b75bc22f79d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460917, "uuid": "428cdec1-d243-4a34-ac6a-8556ff06121c", "value": "B4F3C141C9C5CCE0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460917, "uuid": "49e65aa7-3b8d-4abf-b596-24957894e084", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460917, "uuid": "50390605-2824-48ad-9bcb-9bc0b2e4b3c0", "value": "3072:1uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:10czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460917, "uuid": "c5ef2294-682a-4700-b217-d0472439353f", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460917, "uuid": "d4a7a74c-4821-4c33-b77c-dead005d085e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460917, "uuid": "4b2311ce-50b3-4634-b084-272469145cf1", "value": "2f418246_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50220fc-b005-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620482519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482519, "uuid": "a30853dd-aea4-4343-8683-aecc1bf52bd2", "comment": "Malware payload (Dridex)", "value": "76819ff0cd3d1dfe539a95a5f911fa4e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482519, "uuid": "4872aedb-8a60-4803-94e1-547c19ab8f21", "comment": "Malware payload (Dridex)", "value": "f9a73638514c6f692ac7e6967ee03fb506bd4bf066cf5e11cac620f6d702a864", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482519, "uuid": "3377f207-d7e6-4c9c-8d47-2a9a9a2c85d9", "comment": "Malware payload (Dridex)", "value": "bf4ee7fada0a8b58f524ffb49a8a86bdc963b15e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620482519, "uuid": "c0e66291-8473-47f7-8b03-ebbe32d7078c", "comment": "Malware payload (Dridex)", "value": "3999c62bd855b65ae48628fc49ba4b53dcdbb1ba4ab6671681e18887a5fa4926f14316fe6f7e37af793fd9f61725b987", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482519, "uuid": "717c7fd5-849f-425d-8dc6-80f84d16e516", "value": "14F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482519, "uuid": "5191f755-7625-48b3-b3a4-8c7b17127c2e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482519, "uuid": "3baf9499-f115-4777-b23d-8e9f6d231454", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620482519, "uuid": "f168a69a-6bb4-4d35-8e32-fb289cfd3c26", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620482519, "uuid": "0a3a44fc-b2f9-45e0-b331-18fda9919685", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620482519, "uuid": "f5d4fb87-fd6c-48c1-af04-c775d83060e5", "value": "76819ff0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55341b5b-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "63fa72ec-2af5-4623-ac04-f3418e30de26", "comment": "Malware payload (Mirai)", "value": "477faa19f6265bae3e9383636520ea22", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "d7de444c-e4f1-4c74-9c4e-08e5e1a3b6fe", "comment": "Malware payload (Mirai)", "value": "fa45b5ddee8956f623ed07a4236f6cfb30329c661d723ea52e126db1ca56afc2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "39e71d5d-e2ac-4b3d-bd97-dfcbd21afb29", "comment": "Malware payload (Mirai)", "value": "78cf01f28d618ba4f1162afa88e2601e48f0701b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475379, "uuid": "8776ebd7-93ed-4790-948a-a5b84a70d6e9", "comment": "Malware payload (Mirai)", "value": "bb8f4ca171b1e2fae859d8c5c93b7956e3fb7a282ccf311583538445778e21f095d685b3448e445ab499af42f1d15964", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475379, "uuid": "7165f73b-fea2-4631-bcdf-aa57d5747799", "value": "99732A15B87A2E17C0E4927E12FB8615F2F5330E2470866D3D790F8EFF64684A94A277", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475379, "uuid": "36b5abd4-6ce1-4681-9eae-1da6fb49eff0", "value": "768:b7s6xF6uk1DoKi2SUPqSniZSPz7e/+V1NK+6OajfnuaCWu1IkL8Hqn/LP1rpzwox:/s6I1D1SUPDr4HqZVUJkqjjEupG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475379, "uuid": "060dab39-cb81-4da2-a740-2d50e5ed1aed", "value": 75104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475379, "uuid": "c8bb4b1a-56b1-4db3-8e0a-f2f7bb194a3f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475379, "uuid": "275a1e3f-796d-46d7-ad89-6cd71df90ab0", "value": "KKveTTgaAAsecNNaaaa.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925c7674-afd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620460879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460879, "uuid": "e10275a0-1d10-46b7-80a0-24e038b703e7", "comment": "Malware payload (Dridex)", "value": "a4880b1a9104108beb35a26b658766f5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460879, "uuid": "fd0c6ee3-484b-4720-af40-081023110bd5", "comment": "Malware payload (Dridex)", "value": "faa88c93acc639f2a628af1f04616e3966d7a1713672fa4b36d21127a9d135be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460879, "uuid": "bbd4c444-b052-462c-91cd-5d40a384ea10", "comment": "Malware payload (Dridex)", "value": "da8edb3ae24bf5dc2e1b8c07631181be26db7983", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620460879, "uuid": "94e51313-bc69-4ed7-9416-6d5b05746071", "comment": "Malware payload (Dridex)", "value": "0efe2e623089f7bce9e42d8eb3aa4076572aab961cd0383f6523db52379e0dd22042057bc75837ab539fc4be5d4c8368", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460879, "uuid": "6a4dbb63-8591-4876-8859-fc1ccbe2b1c9", "value": "F5F3D081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460879, "uuid": "c2033815-7612-4fac-8ee2-0f605695231c", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460879, "uuid": "cb1510ca-745f-4ad5-b880-f7fad380b7c0", "value": "3072:eBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eH2H:muXLcclWEc2HeSjNjGdeWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620460879, "uuid": "3ebe13e2-f0a2-4c04-8fa1-32758f8a4a3e", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620460879, "uuid": "802f982c-3d40-4f3d-b517-74797702e880", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620460879, "uuid": "0444b646-13cc-4b12-9818-1c62d2a23a85", "value": "a4880b1a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2562ded4-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620475299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475299, "uuid": "82d7b7d1-07ce-4527-ad94-31377f3e7b55", "comment": "Malware payload (Dridex)", "value": "6a7cff232b12184902e2ec91e08b6e9b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475299, "uuid": "99de35da-e861-4405-b3d8-07222fd82689", "comment": "Malware payload (Dridex)", "value": "fad9dbb0a235424e6aedec50be9eae62487aea296094c8b1e5d3d33f5688be59", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475299, "uuid": "f557d639-12a8-4ac0-a8da-8a448f7ee07e", "comment": "Malware payload (Dridex)", "value": "0daf65147ad42f0dbb16737dd123a683c1292249", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475299, "uuid": "039a6939-d266-42db-9c10-ea2e66db748c", "comment": "Malware payload (Dridex)", "value": "97693f45a16cc7e79bcb964bbd27cf9e5557b1a9a862f18c3e6a9e143835ac6cea6c6764704a0360a59965191195de24", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475299, "uuid": "93397e0f-3e02-4a71-96bb-9eec06484db3", "value": "1EF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475299, "uuid": "9266269c-9fe7-4923-86bc-722e27b9b7c4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475299, "uuid": "e580e76a-17f0-4deb-a17f-9b1a4e7f4f2f", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475299, "uuid": "b569812f-3fe3-4f58-be35-fc28671f8e7f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475299, "uuid": "fc198485-c4bd-4a35-b1fc-b59c94fa7018", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475299, "uuid": "4ac02c4e-1f5d-479b-9e87-ec817d15c12a", "value": "6a7cff23_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e24c78-afec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620471656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471656, "uuid": "05fd9836-24d4-402e-b234-f47b5bcb2b8f", "comment": "Malware payload (Dridex)", "value": "643e3d1e289d7872e2566065295d8393", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471656, "uuid": "27ca0cad-e419-421b-95ae-b9e9d92cc406", "comment": "Malware payload (Dridex)", "value": "fb88480d579bd38e87aa2c5756049b88c414ebb07b33a16c2426b15a61f83885", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471656, "uuid": "a9038068-2534-4b65-acb2-8c2f81055194", "comment": "Malware payload (Dridex)", "value": "820f242db1eb6ade820ca23df00d6322390c4b0f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620471656, "uuid": "a0e67ba6-332d-4b9e-8aba-1fabfaf779d2", "comment": "Malware payload (Dridex)", "value": "55ec8c822712d0f77d9034f4cca8f0078b0281b29e1ef3071a64ef27f6df929224285089755a2f81bf18d93a75f50c9c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471656, "uuid": "7e5bf3e9-94bc-4b32-a1fd-249b00e44b9f", "value": "1BF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471656, "uuid": "6a3138a4-0bfa-443d-8d76-564b944b10ae", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471656, "uuid": "6ee52eac-749b-4565-903a-92b076857b2f", "value": "3072:biFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:4eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620471656, "uuid": "f1797414-3c80-4d46-b7c2-3c1d33d230a1", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620471656, "uuid": "585b8af4-85f4-4e9d-bce5-5f8c7a52eb33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620471656, "uuid": "ac19bff3-6d58-43f6-a154-e682e38422cc", "value": "643e3d1e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04336299-afdc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620464506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464506, "uuid": "d385465d-7a20-4d57-b626-e846a989b7f4", "comment": "Malware payload (Dridex)", "value": "dc6581fc5b7cf53350fdfcd030ce008b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464506, "uuid": "0acd16b1-0784-4ed9-9929-5b07d99a5777", "comment": "Malware payload (Dridex)", "value": "fbe830ac7806d91dc1ef9bba749d027ed9fe5addb01686f028e123b54baec1d2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464506, "uuid": "d738fcac-a94c-411d-aaca-51210e02a347", "comment": "Malware payload (Dridex)", "value": "a61115dcef812973e8e89704e7b8cd948ab04dc6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620464506, "uuid": "6127b210-deb6-424e-a349-0daacf7ca5be", "comment": "Malware payload (Dridex)", "value": "aede41754f3dd8f51a158ecd2ae62c03334935a35645c8e09842ea8d8e98e4eb61b8d238b33ce580968b6800c8b10bfd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464506, "uuid": "40286dac-4c62-4016-9466-8f9e7e22d2e4", "value": "F6F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464506, "uuid": "5e0dda9e-7a0a-438f-a5d1-c4b761d7ec45", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464506, "uuid": "35595530-6c23-42e9-adc3-19793036ae61", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620464506, "uuid": "82acf7d7-1d60-4042-8f24-ccd888068c57", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620464506, "uuid": "e66dfea4-7578-45c3-93de-2d65613ba0bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620464506, "uuid": "185c0961-ab69-4012-bc0a-63ddf894f735", "value": "dc6581fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a101986b-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478942, "uuid": "c7517090-6be0-436e-932d-52f43d4e4cd0", "comment": "Malware payload (Dridex)", "value": "0df6f97ff4aa66708444a93c38c1356d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478942, "uuid": "a8c283b2-55ca-402b-886a-c154761a0086", "comment": "Malware payload (Dridex)", "value": "fd057120c90593b1071791680ee912cf41ceecce63ec1adf0afbb6fa083e6111", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478942, "uuid": "94f46a15-7af5-4319-b65d-74779adaf8df", "comment": "Malware payload (Dridex)", "value": "246323e33aa2818cb198b4702e9b266e786c8112", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478942, "uuid": "21f4f2e5-a951-464a-b3f3-a07380102a60", "comment": "Malware payload (Dridex)", "value": "3af687157a466c0839ac5b8f0f0bf54ae7d7da07d4e95060299996f015824d21c6b2728e903997c108b2b65055364dd3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478942, "uuid": "35db3efe-da8a-426a-9418-6708d65577f0", "value": "64F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478942, "uuid": "5a2d9b1f-9c8c-424b-b807-d56cea41a1cf", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478942, "uuid": "87bc4dfb-8338-4d6b-9fa4-e8bcd281a90a", "value": "3072:ee45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:D4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478942, "uuid": "f849b476-a4f6-4a2f-8b17-5d087953a1d8", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478942, "uuid": "5debf3d9-7622-424d-89b3-b29ff2f06a08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478942, "uuid": "0194cb51-8a68-49bd-8d78-76fa607044ca", "value": "0df6f97f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af1f275-afd7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620462450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462450, "uuid": "e2c287e2-8a3b-40a4-ad25-6ab17ff5cf22", "comment": "Malware payload (AgentTesla)", "value": "48ec48b480a6a7e168da0d935a1d7aa4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462450, "uuid": "2767ab26-d2f4-46a2-a17a-1bfd4851256b", "comment": "Malware payload (AgentTesla)", "value": "fd1dc434508928bc6ebdb5d29de7a1530f64b5d9eb8a9a577f97db741a62a644", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462450, "uuid": "b91e130b-c0ff-42fd-ab0b-675f36fbd9c5", "comment": "Malware payload (AgentTesla)", "value": "3a4a72e84866ca8da0c60505b48a5a530240f2f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620462450, "uuid": "d62073d2-ccc9-4a0c-adf4-64d1cc5950ed", "comment": "Malware payload (AgentTesla)", "value": "4e50527beb98589f1fd424d7ad610f74b0180df1369ce07424ac2139295fd0b7cca5fd35ee564c0d5cb7674393f57792", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462450, "uuid": "f1e57b62-d5e3-4890-ac85-095dd7c9fe86", "value": "EF05F13223D47B64E2BEA7790174911013F5BD41E722DB0EAEE135EF2572B818AB2743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462450, "uuid": "21e7db2f-1dff-43d5-bdaa-7b9d9c2f362f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462450, "uuid": "96d1700f-c64c-4bd5-a1d6-b9f596b5c9a7", "value": "24576:Wg76CgxTVEteEokMdxDIAyYN8303jYXuyu0vlAc:H76CgxhQeEMXfGucvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620462450, "uuid": "b6f9b4cb-0a20-4bf6-a2ef-77850f46d42d", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620462450, "uuid": "d38721d9-d725-4ddf-84a1-97080a9f4754", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620462450, "uuid": "a347bd39-b933-4c1e-8ed1-5f7e5b336b44", "value": "HBL-20210508 INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e77e102-afcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620457302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457302, "uuid": "f5fd2682-dd6f-4de3-b7a4-f0185fbba6cf", "comment": "Malware payload (Dridex)", "value": "a2d05a2f9248ccf1df850025b8472c52", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457302, "uuid": "d5e102dc-2c59-43b3-b0d4-e94d465f6009", "comment": "Malware payload (Dridex)", "value": "fd888f3a6caeb8574cf1ad43e1a8e6efd1a51164017c265e2f90d4cbca4d2ab1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457302, "uuid": "d40b9a44-8b07-40b8-940d-1c11fe045ae8", "comment": "Malware payload (Dridex)", "value": "836d666ac273272feefb6ee2a9452a135104a061", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620457302, "uuid": "da2c04ba-d227-4144-9947-a6d79b2e6dd3", "comment": "Malware payload (Dridex)", "value": "c7e4813c4f69d6f8b024f7ba115b94e855e08c054d872d9d3889bfbda428ce99da764218b91a753a6cfd9aa3adea1368", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457302, "uuid": "3b8f8bef-59ca-41b2-9926-6a9cae3a2ab7", "value": "2AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457302, "uuid": "7b0bc3d0-1150-434e-b880-9e738a093b72", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457302, "uuid": "3f1dd51a-6173-4bf3-ab25-a281559b47de", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620457302, "uuid": "9984c8bb-82b5-433c-872d-6721499a97c6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620457302, "uuid": "2956f01b-322d-4172-a81b-2898efbd0418", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620457302, "uuid": "56bef976-b675-4807-a8d3-0631cc7f18b5", "value": "a2d05a2f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659b0810-b038-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620504183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504183, "uuid": "6683c880-b048-43c0-a468-70550c84af90", "comment": "Malware payload", "value": "7e37bbe330f62d3630e0f1cf34e286d3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504183, "uuid": "e79598dc-9d67-44c9-8eba-2ddfeb8b0050", "comment": "Malware payload", "value": "fe05193cdec77d19b218cc738546e1989ec7538bb669942ab70d64cc27e8352a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504183, "uuid": "7fb3fab0-b502-4dd5-b80a-1dce202cc24e", "comment": "Malware payload", "value": "68f61ca302bb4c9b39b591867f70325fc3f850cc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620504183, "uuid": "3d296f12-d924-425c-8469-3704f6526099", "comment": "Malware payload", "value": "5b7f715246f8415f8f03e090f7655e707ded73196fd6507e8fcffcd27b45cc68e7ae33f17f6b16fe9b24ed988ecb114e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504183, "uuid": "cf4374fd-0e04-4840-b530-7ea09756364e", "value": "E1F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504183, "uuid": "f6fe3725-68c8-45ab-8f29-f7666abbd4f4", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504183, "uuid": "46e2370c-c3f0-4795-9f54-d82360d388cf", "value": "3072:rA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:r3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620504183, "uuid": "3e41fc65-95ae-4fed-8650-0740a21710f7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620504183, "uuid": "e70b7a67-437e-4def-a635-8336b2b7772d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620504183, "uuid": "5b47e3c6-347b-4aeb-bbce-e98ca1090de0", "value": "7e37bbe3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5f1871-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620478909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478909, "uuid": "f2c05ea1-3fbc-4b1d-afb9-df3b8205d4e6", "comment": "Malware payload (Dridex)", "value": "953bb05bed39626a19d0c2aae45e517e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478909, "uuid": "ed9c0712-2509-47f4-a7f1-770e66a5549d", "comment": "Malware payload (Dridex)", "value": "fe0dde582be4b5a5ce6b360a2f4fe16c7ca67f469cbe737f205303333444009a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478909, "uuid": "6af35fc2-8a4c-43eb-894b-edd69ec8b262", "comment": "Malware payload (Dridex)", "value": "6c43224cd6df4c08fb06caa014f693abb740362c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620478909, "uuid": "dcf67127-ec0e-4175-9b7d-0fef0db8e039", "comment": "Malware payload (Dridex)", "value": "d3a9a6c3648c13db4de153ef45c6a17e3e83244b89b8dd622c6287cc8ff5f59196c2bf996cbb2e2ba593e09eff309f1f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478909, "uuid": "c200d416-7815-40cc-ad5d-28c008115ec4", "value": "14F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478909, "uuid": "0680518b-1f59-42d0-8a06-a8df17e10406", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478909, "uuid": "c78c1c21-3e17-41c9-a156-df2b1f611825", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620478909, "uuid": "1424489e-1868-4c13-92fc-5dc82c1f9eb9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620478909, "uuid": "eeb1a606-73b0-4440-9929-1f3b3b3b6201", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620478909, "uuid": "a24d6962-e351-4360-a501-b980feb58df7", "value": "953bb05b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1151d9ee-afb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620446489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446489, "uuid": "b3e13458-9717-4ab2-a0bf-b4683acf37b7", "comment": "Malware payload (Dridex)", "value": "89b7cffe26bc8e2688478bd93988a329", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446489, "uuid": "46265c66-1ec0-4880-a98e-5d331fab767a", "comment": "Malware payload (Dridex)", "value": "fe8bd83c40065c7bb7f45d6cdbb734d7fa92a1a0ea0eaadc7b6b7133d72505fe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446489, "uuid": "cfdf2800-1ea9-4cc0-abd1-83af9ef8611e", "comment": "Malware payload (Dridex)", "value": "09f3ccb15bdd1f74db5e2947ed6b30c29e516aca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620446489, "uuid": "6c3bc0a8-7e04-48b0-8bbb-5e421199fc4b", "comment": "Malware payload (Dridex)", "value": "217a75f2beb02c8e67a12ff6abb3fbd95a977d49658b8f6a84881a03aad21e4cad8920ecbfc7248926fd18ad903e8e23", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446489, "uuid": "31fc07dc-729b-4c9d-81d8-b0f18bd8169b", "value": "C1F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446489, "uuid": "f74b60b8-8dfb-45c6-b7b9-058b932736e1", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446489, "uuid": "62ea26fe-6187-42df-9837-a5419740a0a1", "value": "3072:IuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:I0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620446489, "uuid": "b0dd658e-0324-4a97-81a9-2328741d93e3", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620446489, "uuid": "17a34f3d-957b-4d8d-a17c-2761a15f71d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620446489, "uuid": "465786c9-0d7a-4fb5-8ce5-104c7f24e224", "value": "89b7cffe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579c295d-aff5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620475383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "5f7b8e26-28a9-448e-8a96-e5e3f21854ac", "comment": "Malware payload (Mirai)", "value": "0822d01a1a27a0448e108036eca72729", "object_relation": "md5", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "f2ac6ea8-bd13-4097-b9b4-743987561a7a", "comment": "Malware payload (Mirai)", "value": "fec25ed96a4b303165b76833b9a20e218239689fb15c2f56926b27e43c99ee12", "object_relation": "sha256", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "9bdc58cf-71f2-4e3d-867f-eb70e5f2f359", "comment": "Malware payload (Mirai)", "value": "4f7e450c74fdf2e32924fb2ad585cf8d9d80b6bb", "object_relation": "sha1", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620475383, "uuid": "c4cbe56d-9153-4e63-852f-45af383429ea", "comment": "Malware payload (Mirai)", "value": "6f65f2a3206ff88811c6b68d4362facdea8b971cae3e78a1acba3ff9271de6622b137c4a837beb01465c863afffd92f5", "object_relation": "sha3-384", "Tag": [ { "name": "arm6", "colour": "#001BDA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "0c1bdbfd-9dd7-4191-a38d-38b179044657", "value": "EA03E009414379E3C7A09D7B509C2EC6B9A326FED2FD34778E0A095C2B4004D79F91E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "3d0d71e5-ca68-414d-9bdf-25f17494b1ff", "value": "768:gqd/JTCsRGwhd7o1ayM8g/3SsXsI7cprp8lpDx57Hf5kL39q3UELnB:/dPRGwh61hg/isc+Yil1Hf5AGLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620475383, "uuid": "402295e9-46f4-4b3d-8e80-d8e02a883d91", "value": 38896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620475383, "uuid": "b952d6c8-6f9e-4167-83b1-d09b2a6b75b2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620475383, "uuid": "c8c280a3-5613-42be-b0a2-ff0dc83c19ea", "value": "xd.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7d6912-affd-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1620479014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479014, "uuid": "7a24f2b0-3f7e-4a35-9405-9135dbed2497", "comment": "Malware payload (CryptBot)", "value": "5369a631efaa3bb8a1e001ffa061fdb4", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479014, "uuid": "409b1d63-9f9a-426d-b2b4-c7204d88c27c", "comment": "Malware payload (CryptBot)", "value": "ff1441aa587cc6b6591a65bf0cc3bfee0902dc68816e861eaf4d6223e994b790", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479014, "uuid": "85f212d4-5bd3-4927-98c2-5262267359ea", "comment": "Malware payload (CryptBot)", "value": "9a4342ec04f2d5e763f009d3026a56bdbe63c57f", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620479014, "uuid": "798d6225-7876-4344-9e32-a044127eeedc", "comment": "Malware payload (CryptBot)", "value": "2be2dba69bc946f8fbe13282ab0259169ca25e889a64d9e09e8fb59375c9e43af942d1afbd722a28a56517ec78ece283", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479014, "uuid": "373d101b-fef8-4de7-b0b0-545248937215", "value": "77852310B1EB16B3C9A41AB0DC42B37645AFBD240F188BCB67C438476E725D5AB3D297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479014, "uuid": "929e3376-dd5d-4058-9a1c-b269f19936c2", "value": "a1a66d588dcf1394354ebf6ec400c223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479014, "uuid": "ada5bac6-7474-405e-bfed-9f7ee3688320", "value": "24576:fdW6CGHALglEPhbNtAA7yODUAB6Wzdi2hnFhqqA59PuTIPf+TrlKc3zHNB2In0yS:fdW6CGHAUGPhhtAyUkNnPqRPsNJNMI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620479014, "uuid": "b1b821b4-76de-4dd9-9bd0-d35ace6beb2c", "value": 1746689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620479014, "uuid": "a66b0488-5741-4897-86a4-c60177463ea5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620479014, "uuid": "32d4e634-c177-424c-9ad8-2f7a284dd960", "value": "mainsetupv1.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9eddd3-af90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620432066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432066, "uuid": "f86a4cbd-3fbb-47ce-9e25-f6430d2fe330", "comment": "Malware payload (Dridex)", "value": "62ae2305e04cbe776125fd61c20a612c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432066, "uuid": "ea777951-7bd5-4f42-ac1b-e143a33af65a", "comment": "Malware payload (Dridex)", "value": "ffdf89625be02c6c9eed5e6bdc214b101a2df5cac260b738242a44d812854b01", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432066, "uuid": "3c8627dd-e583-449e-a033-5fe377d102b1", "comment": "Malware payload (Dridex)", "value": "37a7447545dd9d8b539a8039003eebbb9eebe2f6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620432066, "uuid": "cffc081c-4223-4bfc-a6be-0485f2499773", "comment": "Malware payload (Dridex)", "value": "548dd5c3c3bd64d3c6dbdc899f5ec8479dd7aa38443b10061f3266f3b67a1707acccce85e637a29e801866c03ee4c6df", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432066, "uuid": "54a8aa5f-6810-413a-93b3-4cb2587f74c8", "value": "51F3C085DBABE8BFC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432066, "uuid": "cf2daf70-23af-4161-9147-45456a73f410", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432066, "uuid": "d1b342ea-d673-47d7-82c7-1323dd4234cc", "value": "3072:Be45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:g4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620432066, "uuid": "3b81edcb-f1cb-423a-9558-d4d821b7ff27", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620432066, "uuid": "58f9d729-45f8-4185-a94c-0a56536586c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620432066, "uuid": "5d4e4718-9ea4-4bec-bfaf-744322c7b09e", "value": "62ae2305_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }