{ "Event": { "published": true, "date": "2021-05-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-05-07", "timestamp": 1620432181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "6bbbf9e6-153d-4bc9-b0b1-f93dbfe40b1b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776d73c9-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404140, "uuid": "73b89263-d442-45df-bede-bb4865278148", "comment": "Malware payload (Dridex)", "value": "cfe4e8f7c3e2c06f5b24429089d7e878", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404140, "uuid": "b7919203-9c75-49c1-89d5-8c8b550b7a75", "comment": "Malware payload (Dridex)", "value": "0042d818de81474dfe87997a0d2215e02905fee7848028b4d74ff29bfc8d0c99", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404140, "uuid": "754efaa4-0862-4c15-98bb-96904c2a9467", "comment": "Malware payload (Dridex)", "value": "c60d61adf460b73eab990b01f5dd633d9dffbd58", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404140, "uuid": "5a93d15a-1fcb-4f91-890e-351eb85fe743", "comment": "Malware payload (Dridex)", "value": "b8f27dce1b2d6726768721b71e9c395b978edba177227a88f0675ebb0c643125554a5358df46066e875f9a5afef4a1cb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404140, "uuid": "b875dc15-78ee-4756-a9e8-1afb07891192", "value": "0FF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404140, "uuid": "7b21259a-09c4-4972-9ca6-1b2c6784797d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404140, "uuid": "c0591886-18c4-4d5a-a59b-42e60c87e60d", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404140, "uuid": "9e9d385b-ae00-4694-851f-a7e2198a7ba5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404140, "uuid": "85ce0abe-4742-4f79-82a3-4f2388c8da25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404140, "uuid": "e0ac7686-1cee-4327-83ce-22dafffe1415", "value": "cfe4e8f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6693a72-af3d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620396622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396622, "uuid": "5e44b139-6b4c-40f2-92ee-f0e7c3f50748", "comment": "Malware payload (IcedID)", "value": "f4cedc272682f9a9a258a7b9ce5ac794", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396622, "uuid": "6986a254-e405-4cd1-a94a-5dc60c2a07a0", "comment": "Malware payload (IcedID)", "value": "011bc15db92fe83fcbb0904253ef539e88a54d6e6ccef8bbf2d7c5e81413c876", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396622, "uuid": "8d4d4722-6c2b-4d4c-ac58-726ab8c89dfd", "comment": "Malware payload (IcedID)", "value": "e9b9abfca35af5d041ec733fb88f47c3e5b26bad", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396622, "uuid": "835f9024-14c6-48dd-b8fc-a0b1a6e7982c", "comment": "Malware payload (IcedID)", "value": "75a6d05c16e61bb6c31fcc65662df630f8b590e062e7b1f837f03b6783562b81d4c9181c0f4b01da7385a7167165f4d0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396622, "uuid": "b3052c81-bec3-49b8-bf75-b5cef7a56267", "value": "7E347127C5ACE17DF64754F1343CEB89C544AE80AE118DD7A6C6D812AF139F123227EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396622, "uuid": "7ae36a6b-c50e-43c9-b4b0-21bf41a31df9", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396622, "uuid": "58b6a31d-0423-409a-9966-c2dd1940988a", "value": "6144:6Ax88XNHffIYjh6QRdk7fodX67o8ck+EdB7vMqRt6:d88XNHffIY4TBoJqR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620396622, "uuid": "d415816f-7a7a-42cc-8a6c-2d86001ba4e6", "value": 237144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620396622, "uuid": "20529ede-dc58-47cd-9242-05d2d2aada96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396622, "uuid": "6e781340-8d21-4826-8019-1b228217eb49", "value": "011bc15db92fe83fcbb0904253ef539e88a54d6e6ccef.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae03ba91-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392206, "uuid": "7b12e19d-4bb9-4103-abf3-f9994da03eae", "comment": "Malware payload", "value": "90e736280882b55741a949e4d4d2937f", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392206, "uuid": "9ca87c57-a0d5-4e25-b7e1-c01cb2ae6ceb", "comment": "Malware payload", "value": "015e99c30aad45ae07d18675d04fdf5d4ee836ccbf91387d711c142f0f3f1935", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392206, "uuid": "e33f6af8-24c1-4920-8eaf-2e6868943dd1", "comment": "Malware payload", "value": "ea6a4ffcd00281b399e4c0285756187a3fd36f4c", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392206, "uuid": "ca3047e4-1662-4cd0-9f52-76037190adfa", "comment": "Malware payload", "value": "0fe508f3431653b92c2081851e7d7cecfe82abad0614b63c8789a0e6061e86c262579a58dfe3ff9c0574b19cf82964a0", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392206, "uuid": "f702e2c3-65a7-4844-bfd9-abeba1ab81ae", "value": "A7A1F750112C1AB07246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392206, "uuid": "58db6d4a-3cd3-4983-acdc-cf4d924678e6", "value": "96:YRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:YRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392206, "uuid": "105c3c32-20f9-4563-9f25-036ae7336d1b", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392206, "uuid": "6867d514-0b6d-43d2-8025-5709700a5d7e", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392206, "uuid": "4123a3aa-353c-48da-bdf4-99e87c242a66", "value": "015e99c30aad45ae07d18675d04fdf5d4ee836ccbf91387d711c142f0f3f1935", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2edc3fab-af47-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620400582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400582, "uuid": "c483c49a-cf90-4992-9bb1-763e770a5e0e", "comment": "Malware payload (ArkeiStealer)", "value": "2eda089640072a2981f8be88baf1d3a3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400582, "uuid": "af1048b2-cec1-4c5e-9be1-d1b50b10f415", "comment": "Malware payload (ArkeiStealer)", "value": "015f6b7cf4b06273ee48d0a5f7672e0354dcec2d69380bb6eaff063450a3a8cd", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400582, "uuid": "4a4ebae3-763a-419d-a325-a70b31026af8", "comment": "Malware payload (ArkeiStealer)", "value": "5f8552d0ce1965ed1c18fbae90f230a3b5b38fcf", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400582, "uuid": "01cc0d55-a4d8-44d8-892a-517f265cc958", "comment": "Malware payload (ArkeiStealer)", "value": "68c51f45de21e91697974a764e289481ffa97678b5786e2a7c9a5027ccbb4232921f6cda260fe0bee76ac74fb212dc13", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400582, "uuid": "9b2ee1ca-ca71-4d76-99fb-dc3b043e989f", "value": "CEE4E130BA90C435E4FB1AF84DFE937D652D7DA15B2810CB62E49EEE42346E4AC31746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400582, "uuid": "ed6f7389-1d98-40a8-98f5-e56562e4268e", "value": "063255465708c5d561d9303ddc23f4f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400582, "uuid": "1a986dd7-1645-4416-966e-8ee210f2676b", "value": "12288:IkIMKgK/F0AtK/gkWQMYb5ZsqIAYgz5q4p76g1eTMILrNho9BE:7A/6/zbs20U76gslLrM9BE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620400582, "uuid": "a356a340-b607-46fe-9c75-1e9da0e917eb", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620400582, "uuid": "ee056faa-7d8d-41b7-92e6-aa9fa0745525", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400582, "uuid": "7a2f37e9-14dc-4750-b75a-b4969ae4ccaf", "value": "2eda089640072a2981f8be88baf1d3a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d305f1-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407070, "uuid": "1a0d0e9d-0a0c-460f-9fb1-1c747e0d18d1", "comment": "Malware payload (Dridex)", "value": "19d02eaefbc3e691b85b52bf1eb90f12", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407070, "uuid": "1454d0ae-20b0-4bcc-91a0-1be7d072f32e", "comment": "Malware payload (Dridex)", "value": "018bb98bd9a7061104ecce1665911f89f9178c04407c535a5f45844c15318081", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407070, "uuid": "58ffe017-a390-4a4f-9209-85896c65f20c", "comment": "Malware payload (Dridex)", "value": "4d73a994ef3d341495a2769b9047fe59bfa4c1cb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407070, "uuid": "e302a94a-017b-4d2c-b802-b061b8ff4a9c", "comment": "Malware payload (Dridex)", "value": "6d2d6fe55351f7f42ceaa0e09385d84dfbb31be1f2653bae3d87773afee714f64045544731824f1871824bfd8f85c986", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407070, "uuid": "48d1d8c6-f42a-4a34-94e7-93d2b6a79f74", "value": "CDF3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407070, "uuid": "03bb25ee-a655-4c90-aaa9-8a96d9e0921b", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407070, "uuid": "0bf1b7a7-4c3c-4b4a-aa24-09f0c1f4b013", "value": "3072:9BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:zuXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407070, "uuid": "aa239eaa-c5e0-4ca0-8660-9cad76763dee", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407070, "uuid": "77ec54e2-c871-4fdb-9655-3ac7a57f8cde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407070, "uuid": "d23f6023-3ebf-41ba-b59b-e8070de7ad4f", "value": "19d02eae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33003bdd-af8a-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetSupport)", "timestamp": 1620429366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620429366, "uuid": "f65c3169-357c-47ae-80a5-9642b6867038", "comment": "Malware payload (NetSupport)", "value": "778740fde9b90b9dba00950061087e9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620429366, "uuid": "29dbf02d-b443-4d29-8d67-eb5f087e9ee8", "comment": "Malware payload (NetSupport)", "value": "01910bddacbf2ea878b487dd3dfc2cfbeabf1a3dba94309b4a84c9e6b4b4afc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620429366, "uuid": "a9a8659b-2e1e-4e68-acad-9928a8e801ad", "comment": "Malware payload (NetSupport)", "value": "a2b0d310fe8acb98d21ab9ffb7dac7cdcedf5348", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620429366, "uuid": "e5aeffaf-5e23-467d-ac9b-d5b73fb1eb54", "comment": "Malware payload (NetSupport)", "value": "dcfdf41c056b8ad000c4da11f398df87a717d8f8aedfcefa1317d712b6d3d91fc0a8ceb25883b7f4bba98cc173acd499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620429366, "uuid": "28b78bc7-6ca7-419c-bd6b-44495a4f87f4", "value": "7EF53301BBC6A4B2D176AE364C45B705467974102F11DB9AE7882DACEE74960333AFB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620429366, "uuid": "9a1271eb-8202-4141-be0f-1ea8870727a5", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620429366, "uuid": "237dd7f8-8aca-47db-adaa-b8988e81c7a7", "value": "98304:2ciTOmuJBYAZW7hHw1S7j9GbpDSSJicPZQk6iu:GTOFkAZW7hyS7j9GpzIyQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620429366, "uuid": "e0f08141-0389-4e2e-96f6-537f46cb56f2", "value": 3369048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620429366, "uuid": "fa452b5d-19cd-4b2e-8aa6-f72bd388aeb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620429366, "uuid": "82d6b887-25d9-4c18-90ff-9e828c32f170", "value": "778740fde9b90b9dba00950061087e9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f116654-af88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620428500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428500, "uuid": "fc4f7404-e459-4b2b-9ff5-419e593e06d0", "comment": "Malware payload", "value": "990b6cb161bb07b0735458d8b3493177", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428500, "uuid": "a8336bbe-4fe1-49c5-a13e-3a6d3956aaf7", "comment": "Malware payload", "value": "01923f6d0c6f2497c996fee9ec8e53272ba018e89a8b152079e495376e4c67e5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428500, "uuid": "9cab189a-32ab-4c3f-8968-ffc01a177b15", "comment": "Malware payload", "value": "569efbafa4e8d514cc6b4780a53a0ba48a107276", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428500, "uuid": "b58cf237-2325-45f1-9a30-f6bf4ee5a1e4", "comment": "Malware payload", "value": "ba894953402cf99ad39f4446928b7d6fcd0d4de5911a39c206fb43d8e8f70a18306ac7f74fe09398ff4075d9cca10096", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428500, "uuid": "2c59301f-5007-4bc4-95a0-6329856da365", "value": "12F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428500, "uuid": "0dc7b91c-957f-4f6f-8b5e-9e9d2c6f7bca", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428500, "uuid": "f2a331dc-e55a-4633-908d-d432b4ce7364", "value": "3072:aA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:a3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620428500, "uuid": "25db13fb-c64e-45b6-987a-155e9c3f5745", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620428500, "uuid": "534051e0-c9e8-4e30-a2c3-c37bdc9ad854", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428500, "uuid": "85c442d0-ee9e-4469-9a4b-f6c37312208a", "value": "990b6cb1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626e48d9-aef3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620364591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364591, "uuid": "72eeb481-43cd-4e20-addd-88aafefa1d5e", "comment": "Malware payload", "value": "aede0e3fffd02d84321a1a7abb1d65bc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364591, "uuid": "915dd26c-8c4e-45ee-8a4e-d67770744315", "comment": "Malware payload", "value": "01a38195faaf7780f0f600c6d0d6c924559a4e639312e4023ce859e874d923c3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364591, "uuid": "89b64cab-7a34-4b5c-90cd-7f673551a2ff", "comment": "Malware payload", "value": "266caf9b4504ae8b6819e74036ee19af0313fb9d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364591, "uuid": "0932cb5f-f29f-46e7-b115-f6ddda2800e5", "comment": "Malware payload", "value": "0813cfc977c83720fba81f508fab9741468d8902fc37720b0b216e5b588a4b3dd879c3277333edd0d9ce4f2b46458961", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364591, "uuid": "962951dc-e7b2-48ec-aa05-106895456a01", "value": "C9758E17F612D4B2D901167135AAD738FDB0A7540E28DAD3F3E9EE2D7C32452962B20E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364591, "uuid": "3edaab3d-48bd-4c5d-8d41-b8efcc2d7e86", "value": "ec8d67e3b31af8bfc9f959d321d7123b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364591, "uuid": "9b05a9f2-d372-445e-a510-653edb73b646", "value": "24576:fADekZ97AtnXie8U4mwrCmzRYL3iYWV5udjJP/CY9pq/20e1sCwu:f74mkf4hGgcY9A20eeCwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364591, "uuid": "d1d90a5d-882f-405d-bf91-834484249936", "value": 1611304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364591, "uuid": "0365489d-5aca-47d9-b49c-c184fc514edb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364591, "uuid": "5eb25384-b6e6-4cd2-9bcb-3b9759467d30", "value": "sxd2.6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3ca743-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner)", "timestamp": 1620392362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392362, "uuid": "c79eab21-196c-469b-a4fb-850beeefdf30", "comment": "Malware payload (CoinMiner)", "value": "df2dfda3db9f39dfec923dda1b416a0e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392362, "uuid": "c6719d1f-0c09-4579-8116-77368a5117d0", "comment": "Malware payload (CoinMiner)", "value": "01e3ddd288f7a330f514579e7ed44ebce145051c1bdd3e13e738e95bcaaa5e55", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392362, "uuid": "669d9ac2-ba14-4ec2-a125-84d8cf5b55b7", "comment": "Malware payload (CoinMiner)", "value": "8d7fac8cd2888a0921f791441d0467b076b3bf84", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392362, "uuid": "d498d07f-611f-496d-8fa0-e7f82525be43", "comment": "Malware payload (CoinMiner)", "value": "39d1a05a892143278301d86277e63c0ca9cd4b8b7bf3cfed972119062e63dd8f3d2368ae184b566edc71a70fd9c38fef", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392362, "uuid": "b9da588c-b3f0-4e28-822f-2680abbf0243", "value": "0285333E522A3C91C52F823E7EEF0B89D2B5B333F75A195F445E6E13D0BA9227120516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392362, "uuid": "87c716d8-8022-4b37-a9a2-4a1ff0b29e82", "value": "406f4cbdf82bde91761650ca44a3831a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392362, "uuid": "7f7fd914-df51-4b6d-90c2-ec91b0e1ca9e", "value": "49152:HYzt8X3ynuZJ+ylANb01Wgax9jKd9wtfWfY:HWiebIWgax9Pef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392362, "uuid": "3c85fddc-555e-4ff4-9da1-30e7bd1fdbee", "value": 1713152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392362, "uuid": "a2de59d8-af05-4bcc-97a8-0853273aeab0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392362, "uuid": "339fc152-3534-45d2-a569-f3d9eb64f645", "value": "sysguard.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3812fc-aef9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620367265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367265, "uuid": "1bc9a70a-f741-4846-a857-e6c9c25ab6d6", "comment": "Malware payload (Dridex)", "value": "21bf70ca39896edc96f32ca712df85ef", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367265, "uuid": "69eb7fae-ff63-4386-ac53-c7ddfa7f558d", "comment": "Malware payload (Dridex)", "value": "02c1bc680bd11d285ec3d67106f1152d59676cd58e837633b56d6ebb6bc82372", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367265, "uuid": "bfbb4a28-d15c-4452-b658-734e71e683b7", "comment": "Malware payload (Dridex)", "value": "729a0d6e8757ac6a67f42d509920f5e49d3ea2cd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367265, "uuid": "1619355b-ab0e-489a-9475-3fe11210ce38", "comment": "Malware payload (Dridex)", "value": "bbf1fa4cb67b316c893233ce7e965a829a61cc826bb33a148360b4239869ecec8f53178ff215ad86af7183bd8e0b5f72", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367265, "uuid": "0883de36-db7b-4464-ab3a-59d633aef428", "value": "94F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367265, "uuid": "71f420ef-b57c-42c3-96a8-692e1473c478", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367265, "uuid": "6aa582db-5964-498f-ae4a-1845f2001aac", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620367265, "uuid": "72f198d8-95e5-47b3-be1e-0b1cc3817403", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620367265, "uuid": "acc03592-fc9e-4a5f-bc4c-a8740fee852c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367265, "uuid": "9c19b4d7-1321-4e96-8fb7-0776be87d5b6", "value": "21bf70ca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f98ac9-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403951, "uuid": "a70cf9e8-ead2-4061-bc35-835bd263fa08", "comment": "Malware payload (Dridex)", "value": "9ad75f3e51ea663973b2c8c06de81f13", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403951, "uuid": "7155653a-c94f-457e-bcce-3190d82985d0", "comment": "Malware payload (Dridex)", "value": "031817c69247e01a20ddf36155b5ca927542168358f484dbfd22ef50fd03b63e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403951, "uuid": "67df6e6a-8abd-44cc-a774-d11f9805f19f", "comment": "Malware payload (Dridex)", "value": "51848d2bcfc6273c457032c3eadf9ad45f7417a2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403951, "uuid": "848362d8-b2b5-4105-8bc1-2a1669dde00b", "comment": "Malware payload (Dridex)", "value": "cc434fd82d24ec342a4db96ef5175d244eba6dbb5e873d311df7239f329d09eb92287e6420bb502730ab85b3c0e5313b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403951, "uuid": "6733e796-6517-422c-8e33-8f5c989c81eb", "value": "3BF3C141C9C5CCF0CBE36C3A4695963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403951, "uuid": "d6951500-8e6e-4978-8107-0bd0bd271342", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403951, "uuid": "7ffb96f2-4f0b-4164-a59a-57a421aeba94", "value": "3072:RuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+0Hl:R0czbty9uiaJlhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403951, "uuid": "24ecb55b-e385-435d-a65c-63cc74478c05", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403951, "uuid": "d06fc423-b190-4561-a21f-ea24bf6347e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403951, "uuid": "98023338-cfff-473d-8d4e-6e0240d66ee0", "value": "9ad75f3e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5ea568-af41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620398298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620398298, "uuid": "47666c10-c12b-4e3f-a313-dff6340318f5", "comment": "Malware payload (Dridex)", "value": "74965cfb33dc47a7d1a2757effcabd8f", "object_relation": "md5", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620398298, "uuid": "068c0793-a6ab-4cd8-845f-d26a7f54fba6", "comment": "Malware payload (Dridex)", "value": "032f649024cb936e4fc40b22c42400db2fa6fe0275cc585221674584287589f9", "object_relation": "sha256", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620398298, "uuid": "9709e311-08e1-4466-974b-3ead2de1cd88", "comment": "Malware payload (Dridex)", "value": "a05be246432b43fcfa1983630fc936f98cb9ee6f", "object_relation": "sha1", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620398298, "uuid": "0ceb8ab5-1ea0-4518-8f2a-b00747bfd2ac", "comment": "Malware payload (Dridex)", "value": "3cfa1f45ed2dcc4e8c9dec5d20945ed145fa437074bb27a01e9693905a328c31f1f51b633d95732f8749a5c442187d5c", "object_relation": "sha3-384", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620398298, "uuid": "ec93dc5e-9b68-47ce-9106-e647ef3a7091", "value": "27241285D4E7EA17CFA7243A82DA5FA36297909191F3BC2CB509F73CF648D0264A14C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620398298, "uuid": "ab680624-68e9-4db1-a55d-5bebf20cf89f", "value": "6144:jixIO+/ENhLv5xyGBVeJZnC469axilrxDO:Oxn+crRBjeJZ369KYrxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620398298, "uuid": "2cc1f8d6-82cd-4281-9c3a-e7f754f6fd48", "value": 224791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620398298, "uuid": "5ad05b90-a349-48af-a1de-5cea4b8fdb67", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620398298, "uuid": "e23a7736-62a9-4670-8528-7f79395a5b48", "value": "generated order 677120.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465d516c-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404058, "uuid": "dd41785f-2572-4c46-bc03-2cd4f9c01110", "comment": "Malware payload (Dridex)", "value": "bdb61447cbd2869d925c802099d5d7e1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404058, "uuid": "2117c402-4c6c-429c-9907-341aff2ca24d", "comment": "Malware payload (Dridex)", "value": "033b668ebffbeca7528b8e8f9f38455cd8eb9d12ffcd4c57905079d83af733b1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404058, "uuid": "818cea95-1577-4a95-a738-2e9c7b602be4", "comment": "Malware payload (Dridex)", "value": "4ca1aa682a99d06622453da2abd23fad4cceb522", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404058, "uuid": "fa6c5a1c-b873-4cf5-a0eb-38d6f1aaadd0", "comment": "Malware payload (Dridex)", "value": "159460da3e17f81ba11f03f8918d1a3e71dda852bc68cae3ca8bcdf34f2bc0450494b01edbb6b9ac0add414fbe32ebc6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404058, "uuid": "a0de8790-2465-4b28-a81d-d6269bff1c1e", "value": "B0F3C141C9C5CCF0CBE36C3A4695963B3628B941995A8E42EC24CE3F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404058, "uuid": "3d851a0c-1645-4ee3-b8d3-2056af472f13", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404058, "uuid": "ac72e9b2-1d45-49d9-a59c-887451e1712c", "value": "3072:QuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+3n:Q0czbty9uiaJlWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404058, "uuid": "070d04f5-04f5-4cc3-9a2a-599ad21163dd", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404058, "uuid": "0db00969-1eb8-473a-b8a9-a11b4d2aaeab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404058, "uuid": "fd89991c-8f9d-4be9-abcc-f53159e0609f", "value": "bdb61447_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443b3d05-af5e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620410497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410497, "uuid": "5dc629f6-73e5-40ae-8f45-87d44c4e5cfd", "comment": "Malware payload (Dridex)", "value": "d05f2bb92822c11d4fc75c086d50f6d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410497, "uuid": "9097d89c-c555-4058-9872-000f8cdad5a4", "comment": "Malware payload (Dridex)", "value": "0353c3e2ae9f2d165411568bf6a3ed2852ae0ee7ddfa6c525eb2e7355f88d627", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410497, "uuid": "f179ee3e-b28f-45e0-96f4-0784129ef68f", "comment": "Malware payload (Dridex)", "value": "87168c18d4f6644ef6dc4429a8f798c9c219ba37", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410497, "uuid": "7581587b-442f-43a1-87ed-19adce311943", "comment": "Malware payload (Dridex)", "value": "1c147a3216382350963fd6b5ac3ed2470b68f1d1b4bb9b5a7ace10f8011c0bd559079feb701edb6980b51e8e87dd4c3e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410497, "uuid": "57582f74-1a3b-4a71-aa27-13320ccd2026", "value": "09F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410497, "uuid": "33de66cf-fbe0-491d-857e-dcd4228d70b2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410497, "uuid": "4d44d504-4d47-4753-88e8-67d94e762344", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620410497, "uuid": "f087e66c-5173-4bef-9372-926dcee41f40", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620410497, "uuid": "88c04e5a-aa9c-4c3c-9e96-b106501bab7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410497, "uuid": "153fdf0f-c00a-4135-a7ea-f728c1469817", "value": "d05f2bb9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b682f77c-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620385348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385348, "uuid": "c6ce94e3-549f-4459-8e70-a1e209c931c1", "comment": "Malware payload (IcedID)", "value": "23cfb512bede6142ee7c066921b6159f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385348, "uuid": "73246aa7-be9e-4843-bad2-0ab82816e37b", "comment": "Malware payload (IcedID)", "value": "03b8d99fe98be2823443595a513b05bd024fb18da5163461eb649e10f94813af", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385348, "uuid": "45800d70-605e-456c-91f5-f7d5430aadba", "comment": "Malware payload (IcedID)", "value": "c901cea8d0b8d5345ae8cb2131386562c16510fc", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385348, "uuid": "530be5cd-23b9-4a05-9da3-125f9aed2c04", "comment": "Malware payload (IcedID)", "value": "af2dce818bbbf51d6204e1b6875a6d80417f42a9a235cc8b86dc997dc5cfa89e13c6494633bd2641269aee092a3eef92", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385348, "uuid": "5498166e-375c-45ad-81f1-641dc7751883", "value": "3B139E69F9EE52F5F44A89B4F08ED31A661DB222405E1A7FD0258FF3CD56223230D25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385348, "uuid": "01537785-8d6e-46f5-aea9-b850bfe8af29", "value": "78ed290a779aa51d4473678936319a48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385348, "uuid": "8b29589d-5559-4db3-b9ff-61b577eb9165", "value": "768:St5V8AoQM45rBwp4U3Ffi7FtdnRFm4O5mgjNdPz1w12ma2ql:Wz8AdrnUN4tzO5mgjNdL1w1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385348, "uuid": "a89470c6-3abb-4401-9a49-aeed8f452236", "value": 44681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385348, "uuid": "bdce99a7-a636-4235-940a-f5f217763727", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385348, "uuid": "fd48e169-a98a-4a7a-99b3-f9c853c2630a", "value": "23cfb512_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50c8629-af12-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620378125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378125, "uuid": "47479d00-0198-4258-9f89-f9cad7dc0951", "comment": "Malware payload (Dridex)", "value": "6a61c3c982c10dda839b227276fe4aed", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378125, "uuid": "a55660bf-4473-4a7a-a4cf-29b2273bcdcb", "comment": "Malware payload (Dridex)", "value": "03c50443df5552c4b8254785ffc144a8a32b1dc6eb98766aff5d84167a649bf6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378125, "uuid": "f8bdb484-9030-4480-a82f-01d77f4c84e2", "comment": "Malware payload (Dridex)", "value": "1752ac16f01075cca083607ee14c0ba21a7c1019", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378125, "uuid": "9a9a1ae4-c0b0-4dfa-9333-9dd32ee696a8", "comment": "Malware payload (Dridex)", "value": "80d8b870482832460797da58cd791c70dafe9fff4e88e2128d2fc0cd59fcde72393660bacbf3cea90d3c984b1b6aaa11", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378125, "uuid": "ab1a63ef-a0dc-4955-b66e-6540976947b6", "value": "A1F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378125, "uuid": "76546a6c-5360-4722-92e1-d491ac0d3011", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378125, "uuid": "dce2319e-8d30-4935-934a-a0d4abf74c25", "value": "3072:/A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:/3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620378125, "uuid": "38549832-2447-4ade-82b3-6fc1326eac19", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620378125, "uuid": "9ac11d6b-93d6-4178-b428-2113f2f2a151", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378125, "uuid": "19904a46-3c71-4360-9b16-03c67f36e59e", "value": "6a61c3c9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28141cc9-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403577, "uuid": "4d1a04d2-3c64-4f4c-abeb-14cb317ba0c8", "comment": "Malware payload (Dridex)", "value": "de794fb957dab12a4eafa17447f88283", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403577, "uuid": "5626c086-5dad-4575-907e-4fee92620971", "comment": "Malware payload (Dridex)", "value": "03fbb051004c460a07b1cbb74482ebbf30eed210b416c22e051e2f7f3157bc52", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403577, "uuid": "e0382229-3757-454e-b63d-84c6e43fec68", "comment": "Malware payload (Dridex)", "value": "27a89cff2281e067f85ab4a3b7ee8ded6f84c2fa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403577, "uuid": "7ebd3f96-28ac-48ab-91ab-7b0c6b4c432a", "comment": "Malware payload (Dridex)", "value": "26989d6f4ebc3c92c40441ec5817f65f9066663318323c385edcc3b08d3fab0c7a3882a3ee688f5cc472b4314bdee121", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403577, "uuid": "c569b97e-93dd-473d-974c-d207058b11ac", "value": "69F3D141C9C5CCF0CBF36C3A4695963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403577, "uuid": "8e0e8519-71fb-403c-838e-939d8b661cdc", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403577, "uuid": "22284e8a-043d-450b-91d7-32cd5a510b66", "value": "3072:euFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+eE:e0czbty9uiaJlHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403577, "uuid": "8929ae47-c7aa-4652-a81d-f63b972ba14e", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403577, "uuid": "237bd8aa-7741-40ae-a52c-a7345deab9bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403577, "uuid": "5c0d831c-9cd9-47de-a314-7a8390c2f789", "value": "de794fb9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6761f2e2-aec7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620345702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345702, "uuid": "16d3b525-4295-4863-b543-9fe4df265d8c", "comment": "Malware payload (Loki)", "value": "769746f844408bda6432b658b336e41c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345702, "uuid": "f86d5cca-a5d1-48c2-9baf-9fb4a0fe5504", "comment": "Malware payload (Loki)", "value": "042c6ccdc439211a649c933b4f54748e9955277ff435f6319748d744b63028d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345702, "uuid": "3ad89b37-07bf-48dd-85f6-4fe78c6f584a", "comment": "Malware payload (Loki)", "value": "0410678a1eb4acc077d14af96622053d7c4bc8ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345702, "uuid": "7750f0d8-e144-432c-b4be-b2f929770b94", "comment": "Malware payload (Loki)", "value": "9e495015e080744a5de7304464d1f00c6142e6800fff77c6f73227260a7f627382161a72e064b308f7cbdc230580f5be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345702, "uuid": "dac5bff7-aad6-49a7-96c1-537b2a8a4096", "value": "219484C2C54A5E98DC860639C13669BBFE574DB567F264DA039B3D211B322AEB0D3C43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345702, "uuid": "ea2821c5-03cc-4770-bd3e-ad5b48b7dab0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345702, "uuid": "ccbdeef8-f9a0-44a3-bc9d-c525aaf28f22", "value": "6144:ikgbR/t+Pgm2NEi6xGa2K6wiaRSkKLzbvU3c8Np5:i7/Rm2wxydvaRV4zDGv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620345702, "uuid": "049b7d5b-689e-4e36-8699-4b3a4ff39a22", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620345702, "uuid": "7697042e-d68b-4b0f-aadd-ec315084f68b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345702, "uuid": "b8a3f756-8636-4cf9-afb3-99c0c0635d32", "value": "IMG766567343.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a51d96-aef0-11eb-abe1-42010a9c0039", "comment": "Malware payload (GandCrab)", "timestamp": 1620363142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363142, "uuid": "94b20bcd-f0c6-4878-8967-25dbfe2f394d", "comment": "Malware payload (GandCrab)", "value": "b4fc1596157eb7b7900dd1da72c301c4", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363142, "uuid": "e93bb273-f59d-4cbd-9110-d5282377898b", "comment": "Malware payload (GandCrab)", "value": "0452a7ada10bdeda0eb905da0549955f9ce8486ff7cf76a51d73f90a90e89aad", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363142, "uuid": "deeb1445-6c99-4d23-99b0-0b97e3c5966c", "comment": "Malware payload (GandCrab)", "value": "e0c4095c71475036bd79f8bb926fcb575d446d36", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363142, "uuid": "26ded33a-31eb-4bf8-8870-0f12f3e61620", "comment": "Malware payload (GandCrab)", "value": "737058d8dec34c3835c8e4ee80eabd22332d85e55d32f1e5738e2e1de1e35812324d464be61b07bb65603e358ea184fb", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363142, "uuid": "40f6ec31-8433-497c-877a-b0a5b5c175ef", "value": "BF24E013B2D4A871D5270B758D2989807E2DB5400778539F37AB2AAB9F702F08A7735F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363142, "uuid": "8eb2b52a-cfcf-4974-be4d-48c9a63817ac", "value": "c1ed536789620e443598b625f8d0ae7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363142, "uuid": "8ccaeb02-131d-4187-bb19-ecc843d55371", "value": "3072:ePI88gNJMXBNO2gwvT+qaRER85N/0N9eaoRSh+KpVmytJKF7Gb:yI8FNmBJrxR85N/0N9eao+UCJsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620363142, "uuid": "6a5bdb8c-32aa-463f-8212-008f708e28fa", "value": 219661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620363142, "uuid": "db4e2e56-4a85-4f35-b11a-3bd8314bfee7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363142, "uuid": "60d5b2b0-14b5-4152-93ef-a60d2deb01bd", "value": "tracking_number.pdf(2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b0baa5-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620385214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385214, "uuid": "cef24279-b4b9-455a-a5f7-9b8deea0b1a7", "comment": "Malware payload (OskiStealer)", "value": "24e9df3d16780b449b0ec80f25c263b7", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385214, "uuid": "4da69f75-f927-4f5d-b6c8-894d0f2a1c82", "comment": "Malware payload (OskiStealer)", "value": "04739bba7ef80f72f47dd22eb66b9fddb6f48b5c3744b1f9cc6018615aa11bd6", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385214, "uuid": "c4a70de1-0603-44a2-8147-49af8c600210", "comment": "Malware payload (OskiStealer)", "value": "b410b497a791b962e8b9e11b605c291492e542b6", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385214, "uuid": "21caf8eb-f27c-46b9-8f3f-9c2f92650edd", "comment": "Malware payload (OskiStealer)", "value": "9231b12cf5868344bd3872626ae9535147a29cab8ffc0719ebc0b3ee04119b039f00be30887d4d689f8ccdbfd2110290", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385214, "uuid": "f66a9bf2-6240-48b3-bc5a-efaedce60b28", "value": "2B4402009ADCD71BD5B409366AF5C134FF31AF01AD21E5CB2C1BB29A4731BD1A41DEAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385214, "uuid": "442fd1c4-b04c-4048-80de-e94da2e3ebe2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385214, "uuid": "aeefd6d7-971c-44cf-80c8-59b295f0caf1", "value": "6144:sjcZRG55tfUeAIQHuA36cdqkgB9F15T50JESKdc5jTY:aXeeAItC66qkgzF7t0Kn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385214, "uuid": "b452c301-7f96-4245-9d9b-9d987d57b2e9", "value": 264504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385214, "uuid": "2a2d8c35-15ef-4227-9883-57d467c7a846", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385214, "uuid": "945a6977-c48f-49b6-9ff5-ef6a5c1c54d5", "value": "Zguzieszn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee57d6d3-af8f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620431827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620431827, "uuid": "3e2f5fc1-3554-4baf-9344-38e6929359d3", "comment": "Malware payload", "value": "a53d720d1eb12b363f7a86c50462ebcd", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620431827, "uuid": "da519660-e34d-422b-9de4-199bc8130e59", "comment": "Malware payload", "value": "0478fe3022b095927aa630ae9a00447eb024eb862dbfce3eaa3ca6339afec9c1", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620431827, "uuid": "f165414b-c373-4b66-94e4-762e03856c76", "comment": "Malware payload", "value": "0873224320bf7c22f71d50bb7889b901c69363c1", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620431827, "uuid": "cca6fab0-f312-4dd8-adda-a9515a2f691e", "comment": "Malware payload", "value": "4e1801fc294537a4b09f2c9bcc76f5f23664fab44056c2330a4c8043abe23df29a57589e3ef488320d2948493d7bd849", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620431827, "uuid": "c6fcefc3-4ceb-4c6d-893b-6931eda34d1f", "value": "7AA48D07F690E561C02602B02399EB725225FA324223C9C3BBD13FAD6D756E2EB0D757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620431827, "uuid": "7384cc52-0307-4b80-96f0-0fc87415c4d0", "value": "12288:dUTOCol73D56GKCf3LHPcC5F0PGEvGcZX8yeB/cZ2UpnT+wGGwDLqh:dUTOTluCfgC5F0PGEvGcZX8yeBq2UJK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620431827, "uuid": "475ec3f7-9a89-478b-a841-606b44d6569a", "value": 449828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620431827, "uuid": "98c0c2b7-b683-424c-ac0b-dd191a03d7fc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620431827, "uuid": "f0faff68-436b-42ad-9a8a-4e0982463db2", "value": "main", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50a083a-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407223, "uuid": "f85a8bc5-08a8-46dc-a801-bba05a60f3ec", "comment": "Malware payload (Dridex)", "value": "76bfa863e876111cfb1ea9bf2ab590cd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407223, "uuid": "51fc27f2-9a9b-4ce1-ab4e-4a9c74217f69", "comment": "Malware payload (Dridex)", "value": "04968299b6bf066b43586d56869876fbed6f92288869f0c1569b8abf1da4bc2c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407223, "uuid": "e08983a6-a64c-4e83-b62a-2852b6cbd20c", "comment": "Malware payload (Dridex)", "value": "928a2508d09fcf177cee8a8aefb6074c9cf8cda7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407223, "uuid": "3b2d0fcb-6ed3-4153-ae3e-1a770d5461c9", "comment": "Malware payload (Dridex)", "value": "3c56e4d0bf8179980bcc32c3870fea556e82af24542813ce0bcd241f64f527c8f9a858467117406ffde8b09fca6a6bee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407223, "uuid": "ef43eb2b-40b9-4317-ba6c-9937d88d090d", "value": "F7F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABD96BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407223, "uuid": "ee84bfde-d676-49dc-ab6d-83e4a08bbf59", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407223, "uuid": "7eb63dae-3f6a-4668-abfc-f5d5bd9f8f0c", "value": "3072:kBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHit:AuXLcclWEc2HeSjNjGdeCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407223, "uuid": "7361e819-41e3-4db8-be51-7054d869c87e", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407223, "uuid": "646c8715-2075-47cc-a37b-0c02e4654bb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407223, "uuid": "2397ea94-127f-4c81-8e75-28d79566c30e", "value": "76bfa863_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e4fe58-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403924, "uuid": "f65a911c-9de9-4d1d-b57f-3ebc14484cfa", "comment": "Malware payload (Dridex)", "value": "967c3798f1e2b34b162c1d764331f01b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403924, "uuid": "6679cb5d-a7f2-4c2a-a4d1-50b3f9ad05eb", "comment": "Malware payload (Dridex)", "value": "04e2bcfc435961025f54aeced9e4725efefe326ff0e651487162332b5fbf785a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403924, "uuid": "5b0da686-6127-45d8-9b2b-c69da02ed9e1", "comment": "Malware payload (Dridex)", "value": "e956f21474595de9271932e4b7d87ae417fe5949", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403924, "uuid": "0e480404-59a5-41ba-b8c1-8806e64b32e8", "comment": "Malware payload (Dridex)", "value": "158ffd9477e65da96b6cee73ea4330ef3e7f7a30a34d714834833dfce97d074234efee3f006c79ac7d57dbecd374b729", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403924, "uuid": "f061910a-3e0f-41be-9f7c-41b317a414a5", "value": "E3F3D081E7CED5E0FC179B323EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403924, "uuid": "c66c1ccb-ee91-4dbc-a034-6827973596dd", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403924, "uuid": "6955fe79-827c-48be-a0a8-f141cc1e6546", "value": "3072:9BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHaH:zuXLcclWEc2HeSjNjGde6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403924, "uuid": "bc0aa938-50b5-451c-81f1-4132acc6a668", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403924, "uuid": "6a9cbc2e-3ab7-4ba4-9589-06f2795a3c28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403924, "uuid": "9e6ceef0-10cd-4af8-91d7-87a5909f6bf2", "value": "967c3798_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd0bb9cf-af47-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620400848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400848, "uuid": "cc44dfe9-df79-479f-b39b-af6a5fe4f0b7", "comment": "Malware payload (Dridex)", "value": "a250cafdf80db08881d86548a9565bb1", "object_relation": "md5", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400848, "uuid": "22d54acb-03c0-43d8-98d4-53bd52a0dd23", "comment": "Malware payload (Dridex)", "value": "04e7c6f36852658c9a75271f02acedfb52f5d8e9a1020817c0307c05772ac2c2", "object_relation": "sha256", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400848, "uuid": "32478cdc-b11a-438f-836d-30841cae5e87", "comment": "Malware payload (Dridex)", "value": "45e0740cd344f741a1cefd61405781b40225fbb8", "object_relation": "sha1", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400848, "uuid": "31a4fe20-3a7d-4a67-8e5e-9803a17ea37a", "comment": "Malware payload (Dridex)", "value": "4fb65f11ae2306c279135495175809edbbeb35c8047b5d4c7fc14b743e19ab567ece82e18a4ed260117773b4c98d02b5", "object_relation": "sha3-384", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400848, "uuid": "c22921fb-81df-4dce-aaaf-d01e90d05775", "value": "15241259C4E6E627CFA3283A82D95FF36267619141F37C1CF91AFB3CB548E02A4814D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400848, "uuid": "354a7bff-54c4-46ae-af24-64f860152ab7", "value": "6144:leU0wIO+/ENhLv5xyGBVeJZnC469axilrxDaNf:0wn+crRBjeJZ369KYrxONf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620400848, "uuid": "25b324eb-aac4-4486-88f8-86bb95a4dd43", "value": 225034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620400848, "uuid": "656453cc-4caa-48aa-b8ed-ca815d44b5a3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400848, "uuid": "82f76685-539b-4fe7-bcca-4f77775f5a64", "value": "copy of fax 04946.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0201f7dd-af25-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620385904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385904, "uuid": "7159865c-b242-475e-9164-982bc0a744d6", "comment": "Malware payload", "value": "1dd32d1e889b77e24d14fb05f12b52b9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385904, "uuid": "f3b084b1-babe-4d8e-8f2d-68d755ca8ac7", "comment": "Malware payload", "value": "05298f220e88f765a184d56bcbbe00f33cb22523415592450afeee3aeec48369", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385904, "uuid": "26cec97e-8c36-4a42-a302-4c7690a93a55", "comment": "Malware payload", "value": "1e823c643c4feba08f63325ff66131c6c06c3243", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385904, "uuid": "5a317ead-ae28-44be-8684-ccbeffcc979b", "comment": "Malware payload", "value": "3ff10dfbf55552d31441f22b55314171de6c25c2c0ab7c52b2b5647e864ea57151f971fa6baacf6569a6e77b0252d4bc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385904, "uuid": "5800d099-532e-447a-a72c-33ea348235fc", "value": "3E36D62467116062F481F437506103758BF8AEF2B7B62BD39D0FE8D50A7ECC69A39D1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385904, "uuid": "2fc4295b-4bbe-4383-92d1-6b77b99cfb23", "value": "2f0c4c4e9ccdddc0a6945805c33623df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385904, "uuid": "47fca848-29c1-4521-a13c-8e22b906a8e4", "value": "49152:ohPg95YC1yRr5R+jzA66ymAu1Rx48D9d5VGoemcOp00usD7LuWV355FXw/+wWJTC:8gXt1yRr8zA6POQWh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385904, "uuid": "66e9c305-e95e-4d0c-aac3-94d9ee578f51", "value": 5150438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385904, "uuid": "9d5df5da-c422-406d-b881-e378e58c407a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385904, "uuid": "9128c22d-e1d8-46ab-80e6-53e850919aef", "value": "Opolis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cebcb1e9-af35-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620393120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393120, "uuid": "a804521b-f291-4cc8-a308-6fbb1018fd4a", "comment": "Malware payload (Mirai)", "value": "ef3fc0dc298933e0d9bbd45bdab8d24a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393120, "uuid": "cdd9b6c9-313f-43c0-880d-c21353f07605", "comment": "Malware payload (Mirai)", "value": "0535cf682ec3cc41f82910ab522e4ab8f835f3bba30e536cf1ba5cce1c42ac6c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393120, "uuid": "94c73992-5a8e-40b9-9427-5727d255994d", "comment": "Malware payload (Mirai)", "value": "c39b856831cfc8a563c7fe5f42a03b0a5090cf65", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393120, "uuid": "a2fa9db2-0d85-4c33-8b9b-83037bd5aa2d", "comment": "Malware payload (Mirai)", "value": "a377d707cf9b2a69d3caa1d29e850f02cba6e2fad225083c94235eb9f25ef0a2e67e608eba35a32d092ccec12bc7e070", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393120, "uuid": "8d9abb5c-6b53-4b18-8974-7d5b2cd49778", "value": "AB83F642BC929A57C5D423BBFA2E00CD372563F8D2EE3216DD111F24768A82F0DA7756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393120, "uuid": "92569adb-dd97-4f7f-9c2d-8f77118d84da", "value": "1536:aXhDmsuglEILI7OUHKHzbmQCetdiJwgCBKOpa86XK7WIGd42+paV3:aXhDcnEHmQdGJwgCEOpG67WISN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393120, "uuid": "2ca029fb-da93-449d-97ff-324434a606db", "value": 85048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393120, "uuid": "77527fee-da5f-4573-b69c-557b06084f3a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393120, "uuid": "52a5d4e9-3625-4640-b5a7-f715a5085e1f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8dcd947-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403847, "uuid": "a1baf980-329b-4179-9d86-39dbe235793d", "comment": "Malware payload (Dridex)", "value": "946426ef16e429b75159b04f0b0a52a4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403847, "uuid": "5560719e-3675-4f1d-badf-89deb308fab4", "comment": "Malware payload (Dridex)", "value": "0539311b90f9c56a2fc902e337f7fcb3b137c07b7c02d353fa9015afcd426519", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403847, "uuid": "9f598a9f-ef9b-49a5-8923-47f3d6d58ae4", "comment": "Malware payload (Dridex)", "value": "71757b5d009340865dd9fa78f572236255530e75", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403847, "uuid": "3cf865b2-ddad-4119-bdf8-468b094dbfd6", "comment": "Malware payload (Dridex)", "value": "63ee8e2fdb5f88282e4c6f98dbf5888b90401ef08652495bb667a94adf039fb704b0d03d2a9792cd9c74d698318b5fa6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403847, "uuid": "f5c15cff-6d0e-4600-b48c-c1411be311ab", "value": "58F3D080E78ED5E0FC075B333EA80EEF52310087691854E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403847, "uuid": "ebcf90b3-54ff-417b-83a0-e6b9c3a1a5fc", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403847, "uuid": "b1d21221-7b5a-49f7-a621-2329666b7f8c", "value": "3072:MBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eH/R:4uXLcclWEc2HeSjNjGdefR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403847, "uuid": "30f32681-da59-4893-9260-4bf5a5d008eb", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403847, "uuid": "65f21cf2-c132-4545-bd30-3c750ead8eeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403847, "uuid": "6cd294cd-fec3-45c7-8173-6cfcc8ad6bfb", "value": "946426ef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54045ebf-aec7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620345669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345669, "uuid": "b5d0156f-faaa-4f36-bfbd-2851f6f93973", "comment": "Malware payload (Dridex)", "value": "a0bd45a61c0f75321c9f5c281cf970d8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345669, "uuid": "411f7d0b-6c88-4c44-8ebb-cd68d77e0855", "comment": "Malware payload (Dridex)", "value": "0589b32df3f007dcdda373e46f16d513aa1fb2b88b3ff8363c1a11bd7a6d8b84", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345669, "uuid": "2867f43f-302d-4d8e-a40e-957a353feed2", "comment": "Malware payload (Dridex)", "value": "c8fc293093af0e83a79c84f12c61880f34d95583", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345669, "uuid": "ee6704c5-0c00-4551-84d8-b0c655e34c02", "comment": "Malware payload (Dridex)", "value": "3df95dc783ea366a1543b3eb0c4deeaacfb548d620516c2c324a612d76723a122371b77ce3973e60967fcdf65a57abce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345669, "uuid": "6e5860cc-42d7-42ca-94f7-96f2b3221d0c", "value": "93F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345669, "uuid": "9ee20164-5989-4e06-85fb-ff89f4af370a", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345669, "uuid": "37a42a06-5bd3-4b7e-b5c9-ad55834bf620", "value": "3072:ZA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:Z3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620345669, "uuid": "4719c535-dc33-4f32-8982-5f0cf1fe4819", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620345669, "uuid": "f5450d4f-d948-4e6f-9bce-1f388edf8300", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345669, "uuid": "7ef5b9e2-b309-4fb1-a4c6-550843de5f67", "value": "a0bd45a6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d2744f-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403819, "uuid": "bdf2acba-7404-4f51-a06c-7131a3c2e68f", "comment": "Malware payload (Dridex)", "value": "161905cac765bc039936abfdf213a4d8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403819, "uuid": "e6b6220e-f969-41ec-81dd-2e8e06423903", "comment": "Malware payload (Dridex)", "value": "05b6ed56d4a2a199ea1959b090639ee94aeaec431e2c9a25fbeeea50632d6f2c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403819, "uuid": "492d6c4b-c177-4d19-a13a-30361f5b23eb", "comment": "Malware payload (Dridex)", "value": "7b12b9dc12d252564705be3d58bc38fe116705d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403819, "uuid": "921b05aa-dc38-4ff2-9497-8934623647fc", "comment": "Malware payload (Dridex)", "value": "2de2be1b739e951853a858da2601a963bbface520d088177f0e9fae166ec944d1bd8779f4f7a91f2a0d262c132fd848b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403819, "uuid": "f7c85508-ba77-473a-b04d-a38d610bfea2", "value": "2EF3D081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403819, "uuid": "57ce6c82-2459-4362-8109-8a5ffc9ed344", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403819, "uuid": "39e7e1fa-bb57-42ee-8e9c-aa5fb862acbd", "value": "3072:rBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHcY:NuXLcclWEc2HeSjNjGde8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403819, "uuid": "3e5d1786-3ac1-4939-a127-3aa45d027ba9", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403819, "uuid": "e8abd29d-9dd4-4fe2-83ba-068d23089919", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403819, "uuid": "a26ff8c2-6792-45d6-8312-8f3678fcf8e0", "value": "161905ca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d962b1-af39-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620394717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394717, "uuid": "e41a40af-8693-4bcb-af4d-5fa66dba4f7d", "comment": "Malware payload (Mirai)", "value": "f1ba9ae1faf28c2dc7b1646e2fb8f78e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394717, "uuid": "9b731c7a-4d29-4939-af1f-f87e3775568a", "comment": "Malware payload (Mirai)", "value": "05bcef2b563a038711d238a552c111cd408c5753428e02c4e16b23bcfe32b179", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394717, "uuid": "dde031eb-5900-48f9-82ca-aac39621b142", "comment": "Malware payload (Mirai)", "value": "58a86c7ea95b9521ef30cbe929d01044eb428500", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394717, "uuid": "61a32688-91e5-4e9e-8e94-1a1a5dab5bcf", "comment": "Malware payload (Mirai)", "value": "779124953ec7a5fbf1993be68e573f171b8b4bca8a27b925cee6e7537e367237bd1fee887ba458c4f28cb85b1f735270", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394717, "uuid": "87cd08c9-d216-4ba6-8ef1-eea49275e6e3", "value": "EF739EB3E0787DD0D285833926A1C5385723DD16915BBDB4FA468BAA500BECCF41A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394717, "uuid": "286f3e85-bcf0-4f78-9eb7-a62cc8829cf8", "value": "1536:1/o1/Ata2wtGskttBU9JYY/lDGAeIxEQe+CGj6:1QpUlok+/lDgIqQe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620394717, "uuid": "4f7088d9-8ef6-45de-be6e-8102deea2778", "value": 78840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620394717, "uuid": "a2c3ee10-8ada-4ca4-9273-6e76f914b87b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394717, "uuid": "426bc09d-82fe-4dcb-a371-1348cec8308c", "value": "bo.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f91ba08-af38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620394222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394222, "uuid": "2af2d497-33d0-4c6b-8483-4e70310a2bf9", "comment": "Malware payload (Mirai)", "value": "2a822a0cb57ead858b903a31e5d90e5d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394222, "uuid": "c1d2c2a7-c3c2-402d-8cf9-d3df5d5a9ad8", "comment": "Malware payload (Mirai)", "value": "05dcd79e59dfb8ec41d009d51fb576e11e4b342365742e00134ebbf4696aea91", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394222, "uuid": "28a46edc-c7c2-4d83-abc6-8cb0a23fd4ec", "comment": "Malware payload (Mirai)", "value": "97799386dab55f426b636f6390b7420800a951fc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394222, "uuid": "7f624568-f59e-4cbf-a7fe-1517c5d0f5de", "comment": "Malware payload (Mirai)", "value": "152b5872f90302d34333767eed09c4f2246b62bf5bba76275fbcec131076b674a23780230f27952cf4c155ce0c7b5016", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394222, "uuid": "0493ec69-1b88-4ef8-8468-f21c1dd7a0de", "value": "32830782F99784F6C5034D306097F63FDA72E56A0071A7ADFF5D9E25DA37601820B28E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394222, "uuid": "e9bd19f6-eb97-4ce7-a996-f21bba36a809", "value": "1536:gBJjeGqsKrWIWs+l4CO0NFyKCAsPyTp8PQDGqebWv6Z6:gBJBHKrdWs+l4Ne0PyqPDqebWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620394222, "uuid": "8cfc4b95-8fa6-4509-82f6-1b444de71c89", "value": 86800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620394222, "uuid": "bc1c2adc-1ed6-4613-b22a-392a2fddca9d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394222, "uuid": "82429091-d4d8-4af6-96b1-47f6d4023ce3", "value": "bo(1).i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5106dd9-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407357, "uuid": "2e394e82-2000-427e-b49b-dab6cbb0f861", "comment": "Malware payload (Dridex)", "value": "1dada237157731e9981f20f68e073025", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407357, "uuid": "9aaab527-8702-4dee-bfee-375bfcf3170a", "comment": "Malware payload (Dridex)", "value": "062c108d5e8f290df3520f28b01c216a959d127abdcfe8f74b9cf3bc50e5a2b5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407357, "uuid": "3c4a1369-c853-4643-b73d-5594775118e4", "comment": "Malware payload (Dridex)", "value": "7ebacdfdca5cda7c56ceaee924814ee63f6e6941", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407357, "uuid": "55bdf369-356c-43e6-bf54-ebea15ba99a5", "comment": "Malware payload (Dridex)", "value": "090473ee52c7ee3c380bdcc4a3630de15d55a546297e4cedc242727d6f1f324d809f2c8d9c3103e3dda746ff3c43fc34", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407357, "uuid": "d0211a7a-0de4-45ac-8661-cd28e0663615", "value": "1AF3D080E78ED5E0FC075B333E680EEF52310087691954E4EF29DABDD5BB7E15164614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407357, "uuid": "52f5631a-c648-4530-beca-4e5b1d2b54f1", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407357, "uuid": "9bef3777-122d-4d73-bcd1-0f25f30f64b4", "value": "3072:jBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHj8:1uXLcclWEc2HeSjNjGdeD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407357, "uuid": "2bcccd4e-e220-4d56-8cd7-2f90e1619cb5", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407357, "uuid": "9a5d2c15-0499-4bd6-a94b-8853d84402cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407357, "uuid": "ef3afe5a-4505-4acb-b07e-528c9dd49619", "value": "1dada237_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1287ce0-af35-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620393177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393177, "uuid": "8e35650c-a448-4105-817f-dde7fb1d0fcb", "comment": "Malware payload (Mirai)", "value": "c38b1e3fd07033e347d22afaae08df7b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393177, "uuid": "b0fa6121-3997-4161-be5c-fb7117080793", "comment": "Malware payload (Mirai)", "value": "062c6610d4d89de6b2a1f1843cc34b995940019c84e4aaab7d136f36a85fef39", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393177, "uuid": "d2e06766-73ba-480d-89e9-69662f0f6f2c", "comment": "Malware payload (Mirai)", "value": "5c231dd433aa0f25425852d3900da379ec5499ad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393177, "uuid": "6231d90a-9ed9-4d81-b70e-c6cee23bc5b0", "comment": "Malware payload (Mirai)", "value": "191621263a73da1bf83829266886889cef94908a6b7b81a8aeda8d78e7da500e1f609f00a5c8391de12d6a95cf27293f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393177, "uuid": "8205dfa7-802a-437e-894a-193e5bc0fc0b", "value": "78930946B8818A12C5D823FBF92D118D332267F8E2DEB112DD105F64778A92F0D77A96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393177, "uuid": "2a2f6da5-fbcd-4da1-8cb1-d9d33f263561", "value": "1536:JKnX04cMOiAEtBJANr/BLKfAM4LsczmwBqny29CL4i4guCWz5IBi3rbm4ATd42+z:g0CpAE3JsrtvM4LZzmG2964ib+rbm4A2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393177, "uuid": "2e282538-3e6d-4474-b5bc-f5005cfed067", "value": 91776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393177, "uuid": "d242fa50-5668-47a2-913b-32d7c9c9b96f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393177, "uuid": "898fdbb4-1507-43cd-a62d-ea784ce516ec", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac81c20-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1620392254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392254, "uuid": "69f63bc3-463f-4d88-a5fe-8dfde2b5b830", "comment": "Malware payload (CoinMiner.XMRig)", "value": "252abb0504523f55a08c29bbe6460bcc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392254, "uuid": "f73bcdba-95d3-48ee-a516-cc800f20ba58", "comment": "Malware payload (CoinMiner.XMRig)", "value": "06381f7fd865363d44156b4308e09164804ad102d6e493239723b7d89ca30b44", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392254, "uuid": "be234c0b-1ca6-4cdf-a3ee-164d67078334", "comment": "Malware payload (CoinMiner.XMRig)", "value": "0ee2118397347c297e840f3a204a44179f924b3d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392254, "uuid": "dc7837d1-1771-45f3-877c-46d472b79f99", "comment": "Malware payload (CoinMiner.XMRig)", "value": "7a246d53b8d229535a3f583e5066c12d569b26ca508356a4bfd61d534623836ef9c1b54bcb1f6fbbd84072b14ed16ab6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392254, "uuid": "cb1bbcb7-eb5d-43fc-a144-ae6361abcdfb", "value": "2723EB9C766072DFC86BC8729E682C74EA20747B530FD243A05716ADAB0D99BCF151F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392254, "uuid": "68776105-a7c6-45b9-8bb5-c60113e56d85", "value": "768:pYvb54Chz/Cn4XnPu/6MyT4V0rzCU4mLLeZPGmBYc3qigxd:gTCnAvUG8PFQigx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392254, "uuid": "2e784371-3cef-4559-8f68-77a15374b25c", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392254, "uuid": "5b0b035d-158a-4df8-a245-086ba4bd16cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392254, "uuid": "0f09cf42-a667-4b8e-9d36-6501b00c4218", "value": "LinkMiner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb6d72b-af88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620428474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428474, "uuid": "fbbf74a8-b4a7-4544-9940-73bc468f48b0", "comment": "Malware payload", "value": "8f80cfa1503a654697ff2d0ff66edd5d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428474, "uuid": "721f54bc-abee-4edc-b64f-ffad1e2183b4", "comment": "Malware payload", "value": "0658fd9511633cf87f12c87522586b224200a3f0ac7e0801cf23b8fd03638d00", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428474, "uuid": "a847ba7d-b3a2-44a2-ad97-2a9062928762", "comment": "Malware payload", "value": "1b933ecfd131ad8682178d6a031967093dfaa598", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428474, "uuid": "c2c2d0b4-f45c-495b-861c-9496165a6342", "comment": "Malware payload", "value": "568748b2a647fbd0f8f3826693436c57a0617b114cb38b4828b6665c31c41e51661f62a3b6ba742ff4c6dbe3cec83998", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428474, "uuid": "2a172d3b-cdff-47f1-bae3-a6592e9ae0e0", "value": "D3F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428474, "uuid": "74a5fbaf-df52-4378-aa99-96fd690b1313", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428474, "uuid": "96b1ce57-c0d2-4444-bb1d-0a4cdbc461e6", "value": "3072:We45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:r4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620428474, "uuid": "42fd309c-516e-46f1-ac31-835385676442", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620428474, "uuid": "90608784-1377-42b9-b066-042cbb875205", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428474, "uuid": "4e7dbc88-ff9a-4cab-99af-79501c1906d6", "value": "8f80cfa1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb78e71-af32-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620391613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620391613, "uuid": "5b5ece0f-a0e1-463a-bed7-7778f7e78677", "comment": "Malware payload", "value": "6cf7abbebb1d4643d152cbff637fd9d1", "object_relation": "md5", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620391613, "uuid": "d18db8d0-6e41-4730-bc7c-4a7d31ff57d7", "comment": "Malware payload", "value": "06825779a3330fbab4a5a28084ece62188a22d1c8ed1d33700493b16ca9cdb36", "object_relation": "sha256", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620391613, "uuid": "64a0bd48-a4fc-4cfa-9bd4-07313085951d", "comment": "Malware payload", "value": "dda2caf6b5fa923b855730ac43ca658d95237414", "object_relation": "sha1", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620391613, "uuid": "81e40c00-1ec5-4236-bfc2-7efd1f82ceb7", "comment": "Malware payload", "value": "c90b4644b393190520f6783296e74a8550171f7a2ac86a5b396840eeabf127d1fa3cecc5306e19d37b2a4103c7b0e169", "object_relation": "sha3-384", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620391613, "uuid": "d8d3a93d-a0e7-4547-9919-947b17f6f823", "value": "68226D9CB6551B69DFAA73E08177DA2801CC7C3873D120753ABC27A267A773A53140E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620391613, "uuid": "26abc2de-8934-4f62-88b0-97735ae4b344", "value": "192:uKq5TnsWV2h8pPyh1+KMs79ghXBBznnHEPSiMvl8nRtrLt3Z/WrnfO:U5sWuyyrj98XfnnkZal8nR5539gO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620391613, "uuid": "2873dfd8-f7ac-45c7-b905-82f065a5ae42", "value": 10397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620391613, "uuid": "cf8dbcfa-0755-4ea3-b64e-4d1ff1c70229", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620391613, "uuid": "55d70d3d-d4b4-4dbc-8661-dc05da9e4110", "value": "s.dot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ab1e89-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407437, "uuid": "5e5aa474-8250-4e7f-9d0c-44131a982f1c", "comment": "Malware payload (Dridex)", "value": "ade155507f5683779621fedcf8574c16", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407437, "uuid": "8138dec5-3c1f-4ecc-b07d-5ab9887bc0f2", "comment": "Malware payload (Dridex)", "value": "069df881f2a7a04796248801fd4313c518f3d4b64634526fa26a12319a83236f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407437, "uuid": "8bbab63a-6e34-4058-9132-3b1a35798446", "comment": "Malware payload (Dridex)", "value": "552e9271506cf56ea479ac632453e570be939a75", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407437, "uuid": "684ead16-3b8f-4bb5-a9ac-7a14f353c424", "comment": "Malware payload (Dridex)", "value": "4fb2169597ec5d9e32d1164975f26ad76df437e22837b68a4aabc9a3947e2be4fef2e67b891ac09e06b05158136481af", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407437, "uuid": "88dacc7e-96ec-4fa2-9442-d58d6459ebe0", "value": "2EF3C141C9C5CCF0CBE36C3A4695963B3724B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407437, "uuid": "6edae0f9-a12a-4853-afca-c8a62c572ae3", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407437, "uuid": "bbff3eba-db57-43e1-834d-809fa1d57125", "value": "3072:CuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+Lc:C0czbty9uiaJl6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407437, "uuid": "1802de75-a5ad-423e-8a3b-f44f99da1e28", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407437, "uuid": "60086481-9f08-47a8-8c98-7150fab8b771", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407437, "uuid": "621af1f7-a702-48ad-be02-7f2be7e72701", "value": "ade15550_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c96a0bd-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620385197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385197, "uuid": "dd99990a-e68c-420a-8635-2cad0a0fb8ee", "comment": "Malware payload (Formbook)", "value": "5d2f26ac6b48725279d98aa87eff8506", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385197, "uuid": "2655bcf2-8958-485b-872b-18838f25b377", "comment": "Malware payload (Formbook)", "value": "06bed76c389db454d5b86a64bf7127a21c013b48d79b3b83511263c424f5cf65", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385197, "uuid": "9634d6f7-8e6d-49a7-bfcf-17fe5046c360", "comment": "Malware payload (Formbook)", "value": "7ab3874eb9d316a503133367b12d3628e6dbe264", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385197, "uuid": "10769275-1098-4689-ab6a-bd5dbdb4e0fe", "comment": "Malware payload (Formbook)", "value": "090fbd3c301d383cdc594d1a5ddd533a2187ac36afc058f3d4e9b2d8df8fca2be227af8ba7a0601c40dc33c5b6dce4e6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385197, "uuid": "717c074a-8c89-4939-af90-cb28dfc697d1", "value": "8CE4DF2453406E5FC1BD1A7480D8B634A3F0C62266E6E3893E90C4EA1BD57C6FB5BB71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385197, "uuid": "5d0f22d0-a6aa-45ea-97c7-e30c825fe486", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385197, "uuid": "9009bb52-0c2b-4fbb-9f19-d4829db148fb", "value": "12288:iSUKBpaU4YYb8DAKXBhx4Q+gB/n0uVCL+ivuMh3qA+IWYTl9:tBwUvYAkCnyrW0l9vu5AZWYTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385197, "uuid": "5de86765-36d5-4375-9a65-28b7c088bfd3", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385197, "uuid": "0a47bd41-78c6-46ce-a39a-77d2ff7fb089", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385197, "uuid": "2f3a839a-7eb9-4aa1-82fc-d36f0141ce89", "value": "winlog.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba87ef36-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403823, "uuid": "bc3d2e21-ae7a-45ad-81aa-086b30deed95", "comment": "Malware payload (Dridex)", "value": "735794a0b84253d40133ec5d22a43288", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403823, "uuid": "53545c45-b8c3-4abf-86fc-438d16356afc", "comment": "Malware payload (Dridex)", "value": "0719fec3fe683ca0ba1cb6b549646d70a40a8545003dcbd8c57ec5c23f2a5a98", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403823, "uuid": "cef9b33c-c63a-4dff-827d-5f7fbc376618", "comment": "Malware payload (Dridex)", "value": "6a8b02a8878e5977a331e91757288742ca96c537", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403823, "uuid": "3e3064ff-2702-4ebd-9c3c-c69e763e9e26", "comment": "Malware payload (Dridex)", "value": "0e924c677bfd4a210431fed584884443045abed3bbb5ebc4edfddd8faf934f9bb38b86fa59f927ab10f9aeebdc554537", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403823, "uuid": "2d56b115-1e41-46c1-8904-2b0dd3d48e56", "value": "B7F3D080E7CED5E0FC079B333E680EEF52310087691954E4EF29DABD96BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403823, "uuid": "da5719b9-e1a4-4c42-8b0d-71f0d945d77b", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403823, "uuid": "c940200f-d972-4317-8497-11fb91953e7f", "value": "3072:uBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHS4:WuXLcclWEc2HeSjNjGdey4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403823, "uuid": "6ee9f513-beaa-4de2-bd07-6b7b5dbde218", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403823, "uuid": "7e098d44-6311-414b-9130-41c807a4f9ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403823, "uuid": "5e45e155-9535-4139-9ce4-8b614e5149b1", "value": "735794a0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27013ddb-af39-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620394556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394556, "uuid": "ef1551f5-debb-4163-881b-6c34eafa45f6", "comment": "Malware payload (Mirai)", "value": "bce44e10368b738b8b80eec1199de812", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394556, "uuid": "f0cefa2d-3568-4d86-ae66-08d550947327", "comment": "Malware payload (Mirai)", "value": "078c417eda6e631e283c0047c1acb5916cc1e1ae2c4a898c122e260a23953776", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394556, "uuid": "2bbf0713-ab60-448d-ba0a-098da5ea1bd1", "comment": "Malware payload (Mirai)", "value": "e167e761ad0ac386612eb1bc71f9909eca5435ee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394556, "uuid": "974b79d0-c24f-43e5-b62d-cd6269781f09", "comment": "Malware payload (Mirai)", "value": "cd9a5f1ca873c5c7657496d104843e3f7f23a3a3741054fc23f4ffb4aca96f8fca8ec3ff4fb18af770b9760a74cf5322", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394556, "uuid": "91171c63-3b15-4ced-a584-b549afd368af", "value": "88B3951ABF711FF7E89FDC3789A91745299C541A22A93B757930D828B24B24F44E38F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394556, "uuid": "5e7bc230-c1b7-4dfd-aa41-2e02936b6058", "value": "1536:AXu9ZuMM+sOTbn4CzqnKFn4lH8fV2AolhMJCZ3G0qBOeq6:2u9ZuM3JbFqnCCOVJCsOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620394556, "uuid": "90615650-ce89-4712-a32e-8a754f0c7296", "value": 112952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620394556, "uuid": "7965965c-1c02-4fcd-b726-9b863513eaca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394556, "uuid": "f4e92aab-55ed-4a40-aa16-f1c275c737b6", "value": "bo(1).mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5116bfb8-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404076, "uuid": "197a5870-cb34-4e4c-a855-a7732c86ab1f", "comment": "Malware payload (Dridex)", "value": "9ec247f7f3dac92f512a9994027fa651", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404076, "uuid": "009fe242-0635-4a0f-bde0-19a80bfbdc05", "comment": "Malware payload (Dridex)", "value": "07902ecfdebb48630506ec6898cf1b91c7b77ceeb426786f0e44e7a554d376c0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404076, "uuid": "7312e0f7-782d-4d17-a54a-409bc880718e", "comment": "Malware payload (Dridex)", "value": "b4169f1df72bef9055ac0d7b3b6da61170cf6f50", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404076, "uuid": "ab3b2c24-2219-4011-b99f-811673debe75", "comment": "Malware payload (Dridex)", "value": "d435a7a2c4dd61362b5c0bb66610e52b7593bb56c717ff0da97876a8827c5860f7771a43ebef4c503c4ae506f77ddcd2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404076, "uuid": "692f3694-9898-439d-9d02-ba4594635990", "value": "1BF3C141C9C5CCF0CBE36C3A4695963B3628B941995A8E42EC24CE3F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404076, "uuid": "414cd254-9d56-481c-8cc5-2211e5d52400", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404076, "uuid": "1735b588-f81e-4eae-a9e7-9daa690aaf74", "value": "3072:cuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+3n:c0czbty9uiaJlWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404076, "uuid": "a04f2518-0a6b-4dbc-8b80-98e846ad4d20", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404076, "uuid": "d51a67e2-8631-4a3c-a965-c68c2e5968aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404076, "uuid": "d0070ba8-a0d2-468b-92ec-510637d2a5bc", "value": "9ec247f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d81f4ed-aed8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620352906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352906, "uuid": "8a2e6aa1-7008-4c26-9437-1537a1af62cb", "comment": "Malware payload (Dridex)", "value": "f2f679dd2b023bd00ec00f480033127e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352906, "uuid": "413f2fbd-f1a3-4c68-9785-34ef8fd06c11", "comment": "Malware payload (Dridex)", "value": "0797b02a98874be5a6efaa23955fe0d8d6977860d16f0951cfb5ae6b6545fc0c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352906, "uuid": "5af7b1db-1559-461b-bd5b-ed9e09dccc73", "comment": "Malware payload (Dridex)", "value": "7b05f80129beda2ff39a590d05578c6ebb76ebb8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352906, "uuid": "8d3516de-fe20-41dd-b0ad-5e0783e977bd", "comment": "Malware payload (Dridex)", "value": "ea6c425fecdb2beebdd020ebf7a77711ac4863b01544b8f759a990e9912e656c99a12d9fbffd699ffd7a8d9c459bb134", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352906, "uuid": "09fa60bd-80ad-4f8a-aa3a-838fcc6ea8bc", "value": "43F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352906, "uuid": "6a19fb65-2bd2-4b98-a3a3-4903cdea55cd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352906, "uuid": "1e644e69-bb62-4541-9ae2-c998170113e1", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620352906, "uuid": "6b64f764-d296-48a0-8231-ce68dcf627de", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620352906, "uuid": "12881c63-2e5a-4f54-a3e6-8830b9fae112", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352906, "uuid": "0eea91c0-e274-4484-aae0-a66ef7fdd343", "value": "f2f679dd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8eecd5-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404065, "uuid": "6174bf94-4f61-462c-b87d-789a48ffaae9", "comment": "Malware payload (Dridex)", "value": "82c1bb4ad411863d7d4d496d5ed2dd0e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404065, "uuid": "ec740409-e4ab-42e7-8e30-1a9461407b32", "comment": "Malware payload (Dridex)", "value": "07e83d93ce0913d87b1ddf2d1b5973948dbc7db547a3602ee31f8b3938244e7e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404065, "uuid": "4dc2369f-8bb6-4f3b-afaf-6602cc90ed9c", "comment": "Malware payload (Dridex)", "value": "1e0c6983d2ecd53f123b1306ab52355ba0e870fe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404065, "uuid": "8bd8a55f-3088-4dc0-8fff-788d2fcc3e4d", "comment": "Malware payload (Dridex)", "value": "a22fff3f2eecb19356a29a6de2e4d8cfdee3e3e90cdb394c91a4c55884ed7c82c22b59f5f99da5e71aa2e4f21d408ed3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404065, "uuid": "282dbd20-7fbd-459c-abf6-e6d99ffe0c5e", "value": "A0F3D081E7CED5E0FC179B323EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404065, "uuid": "1e4d3f96-926e-41f6-b1f1-410a406c6353", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404065, "uuid": "3042dd28-f766-48e6-9e3c-2dda7418f407", "value": "3072:VBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHaH:buXLcclWEc2HeSjNjGde6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404065, "uuid": "49942b7d-4f47-47b4-930f-4c2d8f5c20cd", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404065, "uuid": "11a4133d-6e16-46d3-b108-a6e5a68ffe63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404065, "uuid": "0b5c4cff-74bf-4ddf-a38c-af8df5ab947b", "value": "82c1bb4a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80426f14-af72-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetSupport)", "timestamp": 1620419187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620419187, "uuid": "2aa65419-6a5d-43ca-93ab-d9f8ab05189d", "comment": "Malware payload (NetSupport)", "value": "7b030fd1473bd9b213a6da3ef3adc19e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620419187, "uuid": "bdd77bc5-7643-431b-9304-4f58a7058f8f", "comment": "Malware payload (NetSupport)", "value": "07eaa6e88904f46157a5e5e45dd70d6e14d5d06aae7dc17e8a2c440ff403a51e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620419187, "uuid": "d7e46cbc-1000-4038-ab27-2797b5ec7007", "comment": "Malware payload (NetSupport)", "value": "3fd6debb83d6b9b6240408fecef9946163d5a493", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620419187, "uuid": "e4ceb77b-dd79-4a56-ba5e-54fed076ebfb", "comment": "Malware payload (NetSupport)", "value": "1573917e569b3b53d5dcce31ac2d476ccc1534c8ac721ed7f6b267bcd04b0d17157e6056cdf672db1676b261e3979889", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620419187, "uuid": "c62ebdfa-a2ad-4b9a-8eb1-69209c2ccfb7", "value": "FAA57E21B2C2C837D577263C9D5FA3985829BE301D38A44B7FE45E4C1F796813A2E297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620419187, "uuid": "c1dc6899-e1c7-4c90-a54f-db8317f04566", "value": "530c2a5d4e324018cfaa979ca3d61019", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620419187, "uuid": "1713e80d-48e4-4b32-aa88-2f3f33e3b266", "value": "24576:lqHY/QnvorgplWSIoi2H2B8bLSUXSatAH5ZdIZpWnygytoMWcy/XByaGERWqSUOo:lqHmweDUO1vxwt8cyOjxHHkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620419187, "uuid": "4c18f77d-495a-4447-b956-7d30e0d85df7", "value": 2142720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620419187, "uuid": "2caa4f4b-d5e6-4617-934a-eaecccf53fd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620419187, "uuid": "3d55094e-e94d-4467-a084-9403d1d0ea07", "value": "7B030FD1473BD9B213A6DA3EF3ADC19E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae53f43-af37-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620394053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394053, "uuid": "0aa0eada-a792-49e0-9199-3766edf7ff04", "comment": "Malware payload (Mirai)", "value": "69bb0aa5ab5e01c208e75f5e6ec5336f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394053, "uuid": "fbb5de80-5d44-48bf-9e2d-0fa5880a7775", "comment": "Malware payload (Mirai)", "value": "08247e5bd64ec9e6b229b680b02076a672e7ec1fd4a29584989412b9ef6f5146", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394053, "uuid": "cfecc2b2-dc09-4a8b-8ac3-0929b1d21587", "comment": "Malware payload (Mirai)", "value": "c265674b5e58af7a49e502503cb07c9f97bbd2ea", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394053, "uuid": "ab015eef-da39-46bc-aebd-0d5c788bc1e5", "comment": "Malware payload (Mirai)", "value": "c8b332914606d1b0f8ae7c94d35a6421f0a725f89411bb9ee08dcadf368f83cd30cc85fe0175188894f5bb98d37d7af6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394053, "uuid": "04affc10-b995-4a25-87e9-6ad672b55927", "value": "2C830895BC918922C6C413F7FA6E118D332263F8D2EF7207DD146B6836CA81E1D3A656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394053, "uuid": "05b4c3e0-9526-4218-989a-547d0c232cf8", "value": "1536:U0MUs2+E+H3w73T/v87eIreI+5G6+yA4sAw4DTjbNQvt5cnlD5GXMaT56GM6:U0ZsHEhS+Zk572jbNibclDSTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620394053, "uuid": "038d5720-2c3e-4be1-aa8a-8d4467b501c7", "value": 87104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620394053, "uuid": "983c3d8b-b8d0-4d23-ad18-6428ce1fb283", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394053, "uuid": "e8c6a125-dc12-461f-961e-3fae4515ad64", "value": "bo(1).arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d762f14-af47-11eb-abe1-42010a9c0039", "comment": "Malware payload (WSHRAT)", "timestamp": 1620400607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400607, "uuid": "65209bc4-e87f-42b9-878b-76ad1e2a932b", "comment": "Malware payload (WSHRAT)", "value": "42a64b54a8bac7a04f617b63a86607bc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400607, "uuid": "dec86b77-2d81-420a-bf59-7c5571453854", "comment": "Malware payload (WSHRAT)", "value": "0865efb9884b591580acc139957fabb13e80bcc5ee6cc4d4f4c40bdf334016a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400607, "uuid": "2e586d8f-bbc8-4dbf-91f0-bc2f5855e71a", "comment": "Malware payload (WSHRAT)", "value": "413efbdafa8c1c4aa31be97c4b7ca8d70921929f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400607, "uuid": "1f137653-4f3c-4c15-b7cd-24c737dc7e83", "comment": "Malware payload (WSHRAT)", "value": "aaf7c0eeeb65ebe86180a724f1cef0df9a934667b93f65417395cc41a69115667e489031b382e5dcbcf311057227a472", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400607, "uuid": "47ef5049-b869-4cc2-b284-7b228e4b6387", "value": "2DD4E04535A13517DB35DA60EA02BE2AA8287D171CC323C567C63B4EFEF1D483AD628D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400607, "uuid": "cdaf030e-c4ab-49d3-b207-99be1ea107cb", "value": "1536:BLLSwyfkIVfzIdWhmThuyj0GVIrnRqvxmP:NLSwyfkIVMdWhmThujGVIemP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620400607, "uuid": "4158e0fe-d717-4c75-8ae9-402a60e0c834", "value": 641430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620400607, "uuid": "9da397b3-98e4-4fa4-880a-66ab013f3ff9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400607, "uuid": "1e994a01-a688-4847-91c1-fe505951c613", "value": "07052021.PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e58191a-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403776, "uuid": "b2abb23e-72c1-4932-ae89-50364083fd3f", "comment": "Malware payload (Dridex)", "value": "9515c4049e95433a9f7641c888c6c85f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403776, "uuid": "1f19bd9e-1482-40c4-99f4-ca394010e1b9", "comment": "Malware payload (Dridex)", "value": "086774c3831551206143ffe857e30c37c2023532cea44e2f5c3f9b48e104edb3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403776, "uuid": "02b88f0a-213d-4356-9e89-ec1c6e75505b", "comment": "Malware payload (Dridex)", "value": "e2616bea5628572384c1367b5e4dc65f70a0ac93", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403776, "uuid": "ed20a726-01f0-4812-bc8f-be601e51b726", "comment": "Malware payload (Dridex)", "value": "9f56805f7ffc1a71fd0da5603d9ed7cbc05ad9b66eaee7a5e5ffb1b0f77e16a31f94dd2f9c6e88c0bd4638aad2b2b154", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403776, "uuid": "3b446c84-555d-411d-981e-90c199f48ec6", "value": "F0F3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403776, "uuid": "60559f49-e9af-4333-96d2-3c5d23be469c", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403776, "uuid": "002cf5cd-027e-4a9d-83e1-9266a8686c81", "value": "3072:gBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eH/R:UuXLcclWEc2HeSjNjGdefR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403776, "uuid": "684f8c3b-7e05-4521-a94c-73dfe835ad51", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403776, "uuid": "62fc0683-99f3-4f4b-bc1c-87c6abf2d24c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403776, "uuid": "d1ef57dc-6fde-4806-bc07-7bf6ae32576b", "value": "9515c404_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4029a4-af47-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620400898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400898, "uuid": "0141006c-40fc-4886-bb59-62e4246bf628", "comment": "Malware payload (Dridex)", "value": "3e94540a80814bdcab2b1692134dc2b4", "object_relation": "md5", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400898, "uuid": "c2f1f20e-de3c-44ea-a596-2a3c9dba6117", "comment": "Malware payload (Dridex)", "value": "087529780569ebbff706dfa31cef26c2ab2336d0fa1cb851fc9071dcb22c3f69", "object_relation": "sha256", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400898, "uuid": "e9a34a1d-94f1-44ec-9fd9-f40c56d2a20f", "comment": "Malware payload (Dridex)", "value": "bbc1ab10bfc0bd5e9901097c89e19c8d2dc6e146", "object_relation": "sha1", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400898, "uuid": "758596a4-cb12-49f1-9c4f-5b70c5b47d36", "comment": "Malware payload (Dridex)", "value": "a202b8650a6513a557549205d27d01c7fd8c5520d313eccf335049b475f570e3cce263478e6318cb2d57379d0eb5a48e", "object_relation": "sha3-384", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400898, "uuid": "1ce09e16-087b-456e-9c1e-81d2de2f9a00", "value": "F683F29D8835EE36D82B0731D3690F472CA766F7D5C29619F751904E2A80E4ECACB492", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400898, "uuid": "fde95aa7-4a08-4a53-bab9-742fdb3fc94d", "value": "1536:LVWbcqX4ogjDd25lqlqdnxlEZL4C+PvC8PCz5IuR2ZH7DuVrBJb5Kxcz:LOKPcr2Inwz8Ez5IuK7DuVQxcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620400898, "uuid": "6a409990-7b87-4643-8225-d0f548b1eb14", "value": 87586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620400898, "uuid": "ae9832f4-e133-4334-8e17-ae21addd2c8c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400898, "uuid": "495b104c-dfbf-4acf-994e-acecdea99a21", "value": "scan of fax 13292.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1258f3-af37-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620393733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393733, "uuid": "353390ed-f818-4b3e-9128-ab2c339d8240", "comment": "Malware payload", "value": "e7459a3b5236248bc97f72b5b698454e", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393733, "uuid": "2201f673-17a3-41b9-85da-b51cdbbfdeeb", "comment": "Malware payload", "value": "087c876b21a643a087425ec239743745ef367490abfff9b9abb54489fe73120f", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393733, "uuid": "d080e463-827f-4aff-9d7c-0f9b0983dd09", "comment": "Malware payload", "value": "ce634b1260b6b8501c384fb97339e5087b15d245", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393733, "uuid": "e7538671-6ec6-4d2b-a9aa-f7b2560c0fee", "comment": "Malware payload", "value": "18407b8f235ad2e28363953a094905b830a2e04b080971cde59235e4ecad7ad601725dbfd7ecb8bc8e4c767dcf60b597", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393733, "uuid": "d9757ef6-504a-488d-8ef8-334bf609b9bf", "value": "92E2E16245919EF0EDF00C32B03C4317BA5127F5885F3B39AA8649AD79D08C67DF96A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393733, "uuid": "718778d1-f40f-4089-8de2-1cd110cf0df2", "value": "768:P7su7jCsABDfJIkX4Sg/6JdtqfN4cpy2Tlbpq3UIo9:P7su7j9mJIkXNg/6JdtY4gFZGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393733, "uuid": "b9db4ddb-05ab-410d-a87b-294328cb76f4", "value": 32864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393733, "uuid": "753cbd0c-2c7b-491a-8d22-89910babd10c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393733, "uuid": "fa11bc45-f90b-4d7c-b40e-f80b9329383a", "value": "blxntz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab235ec6-af7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620424843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424843, "uuid": "db051ae4-fbe0-4ba2-814c-a58531eff68e", "comment": "Malware payload (Dridex)", "value": "6fde0c7dab61cec493d8a1c75ac394eb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424843, "uuid": "3ac6f1e3-f17e-487e-959b-6732ff3001fb", "comment": "Malware payload (Dridex)", "value": "0887649136d537368253caf8729236259a1bb94c2d3cb6d14feb0f2a6873621b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424843, "uuid": "6101e8f5-6cc1-461b-b12d-20bb90136bff", "comment": "Malware payload (Dridex)", "value": "96dd8a49cf7baafc9e2e1af12c60f64d111147a8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424843, "uuid": "a8bf6db4-09c0-4c7d-ad0d-853a1cd1e0d7", "comment": "Malware payload (Dridex)", "value": "45d7c2cefb38b7f2a4e4df571935dd9c6d27d329e556140041e22e1130b34670ed0b051004e673afb10726faa4d090aa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424843, "uuid": "f4ebf3ad-08ce-4ede-90c6-bea96c5b08a9", "value": "BCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424843, "uuid": "6a7525de-a566-4942-9af2-e5dab4d922d6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424843, "uuid": "4b964005-0915-441a-bac0-b5241b1e2ad8", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620424843, "uuid": "bc77574b-9f54-4330-8103-b6bfcf2444ed", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620424843, "uuid": "e1188061-2c57-4c60-b757-577f994e33c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424843, "uuid": "cdbcbc04-01c2-4512-805f-a16c133eeb91", "value": "6fde0c7d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1903df3d-af1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620381648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381648, "uuid": "a20bca43-be81-4616-b76f-116ca519596c", "comment": "Malware payload (AgentTesla)", "value": "93927c38702ad5de0fa3d1e9ab1b0e57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381648, "uuid": "d787e2ed-9473-45b3-b7fc-9b03ad5030bb", "comment": "Malware payload (AgentTesla)", "value": "08b64b4bd7191df64c3b46ef1bb57044cabbafcf80588395742c4532dd63fe6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381648, "uuid": "252daf65-0fed-433b-a059-5fd449796160", "comment": "Malware payload (AgentTesla)", "value": "14dde7d938810b7486612b8bbd518dd59380baa7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381648, "uuid": "30d50806-f449-470b-9a0c-c0743daf7cc7", "comment": "Malware payload (AgentTesla)", "value": "f1b8afc74c91d27caabec560ca1f355b859ef76260870ca40a78da5a47bc66d1570175dc9ce05064c04fa655a4865614", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381648, "uuid": "70535d94-5635-4814-885b-d362af329863", "value": "D805E0122385CA65D93A6779D0A053F023F2BD01F662DE0FADD17CAD7A32AE107856D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381648, "uuid": "0848d72d-83c2-4bc9-beea-1a146aa38d44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381648, "uuid": "807dc766-db54-4ef3-bf96-0fe6e81a2e20", "value": "12288:530l1yDtlfUxajlRruE8WZZqAHNDLTrWgc3VIAgzzV9oq6D/g4oRM:5EfSlfUQRFj8ulLP9cSzB9xw/3oR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381648, "uuid": "8ef999a4-378d-4af4-8151-0e3d0e3767cb", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381648, "uuid": "865ae2a3-9b4b-4da9-9d08-ba5ec86024d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381648, "uuid": "3811e2d1-c6d9-47a8-b9e3-fafaac8aa62b", "value": "93927c38_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caee64ff-aecf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620349305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349305, "uuid": "e32fe086-4a41-4dd5-976b-f43c70b5d630", "comment": "Malware payload (Dridex)", "value": "b2ed40a1261cda89c8d8d423f05a7c6d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349305, "uuid": "ac8c1e26-d248-46ea-ac43-c6c932180996", "comment": "Malware payload (Dridex)", "value": "08c9ef4c4b79af918ebb4873e1c2c42e951e603fb8b7952e8d3eec8653b72a64", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349305, "uuid": "604ff4fe-f7eb-45fc-9c89-84a82c697632", "comment": "Malware payload (Dridex)", "value": "9a8212f88d956cb099564440fadb59c977a11981", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349305, "uuid": "9360238c-5877-4687-9957-745c5e50607a", "comment": "Malware payload (Dridex)", "value": "0418bbf8043e7f64e1e8b83e6b7153075d23b091662dcfe5487d323e3f8365fce9405e30fb8418b1999ce01ef0706ce8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349305, "uuid": "7031a8d3-3900-43d7-83da-e882fab52cd4", "value": "54F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349305, "uuid": "3b38dc9d-00dd-4a58-9af9-f1bf5d68e0f7", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349305, "uuid": "4b7b2147-834e-4685-9ba7-029fe9fcaec2", "value": "3072:viFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:keAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620349305, "uuid": "c9b7d01b-4705-4245-87d1-8734b6c0edb5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620349305, "uuid": "2f1cf5c2-a218-4e7f-b805-2858ac1ca4cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349305, "uuid": "868ed143-4723-490b-8fb0-888849f8cbf8", "value": "b2ed40a1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94555514-aeee-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620362527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362527, "uuid": "ef939de5-9d43-4a94-8324-5e72c7f1c4df", "comment": "Malware payload (ArkeiStealer)", "value": "6d982fa4f9b078255c1167e9889cea9b", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362527, "uuid": "a65df47b-18e4-4820-9ac2-f2ddfe3192a6", "comment": "Malware payload (ArkeiStealer)", "value": "08f265523a5b4db4009f35c57c6f71dca1d0f6a8d00880d1853879158e98d5f0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362527, "uuid": "81f5b494-2813-49c5-b2d1-8a211881287c", "comment": "Malware payload (ArkeiStealer)", "value": "f94ec84e94f2db1467acd0c09af3e6d218182f64", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362527, "uuid": "52b1f5a4-db1d-45ca-bde6-a7883dbc7657", "comment": "Malware payload (ArkeiStealer)", "value": "d19a261734432d89e1890f36e20d5bdcf466cd39d6b5dcaaf541fc71fb192b336cbb1c4acadb832c686d389e92d2f5c2", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362527, "uuid": "0d67f07c-348c-4774-ba36-4622876b7a20", "value": "0FE4E130E6A0C031E9B701F849BA837CE52CFE605B2451EB52D51BFA5634BF96D3129B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362527, "uuid": "f81a8888-1cb7-4254-af81-dff4b626f506", "value": "34a67fe119290f5d8e9e21661874bcdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362527, "uuid": "9fecd078-daf3-49b0-a87e-71cf598fb6c8", "value": "12288:5fW+j769p9hcwG6A5HdEPpRxjVIYGYp0ZOI5vOj4WZDac/WZL8X:VXaJA5KPpRxjVI/YKEOu4wGc6L8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620362527, "uuid": "b2762953-f8b1-4fb7-bb5a-7a7e8faaede6", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620362527, "uuid": "3d8f36e3-0bab-4863-9e4e-b4054ca6dfb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362527, "uuid": "ae840dff-96f7-4834-9113-b428733f2dbd", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d100ed00-aef9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620367354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367354, "uuid": "0c1e10f0-ba7e-4a1e-98a5-2a695c19026d", "comment": "Malware payload (Dridex)", "value": "e23733cff07352cc285c39e3a375cdad", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367354, "uuid": "1e0f0ea7-aacc-4e6d-8479-ec4bdee35e2c", "comment": "Malware payload (Dridex)", "value": "093cd979225b35e48c693a472a178a9343d0c0ee76da92b4f4926d59eb661bc3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367354, "uuid": "431d47de-ac83-44fc-a433-e8c8a0896f5a", "comment": "Malware payload (Dridex)", "value": "ac8af6cbd7cfd9cf2d09744a7eacdd7638fa98d4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367354, "uuid": "30357a73-8dcf-4673-bce1-8d4f27012081", "comment": "Malware payload (Dridex)", "value": "885e4cb84c02da33668c44837af42d51fa000ad970d1036d01bf7f322a8d6600048ce6bc73808132390cdadf1a89c2b1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367354, "uuid": "2a6e3f13-9560-4bac-92e8-5daa87063ae5", "value": "34F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367354, "uuid": "5ee00958-0e59-4651-8c10-220e1c39762f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367354, "uuid": "38917812-38e3-4ce2-b401-6a513b1bad37", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620367354, "uuid": "9fe98f8d-f859-4dbd-829d-9a439b2086a3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620367354, "uuid": "0748c326-4f7e-4511-aadd-c6042b71a8e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367354, "uuid": "43f67bef-fccf-4adf-b6dc-bb683b817940", "value": "e23733cf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c8e4fd-af0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620374531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374531, "uuid": "3a1fd86e-ae25-4ade-9e11-24070a63777a", "comment": "Malware payload (Dridex)", "value": "7a109c501809ead00a8a3b2393212396", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374531, "uuid": "1f0e8ac6-d284-426a-bc77-7c26e81d53de", "comment": "Malware payload (Dridex)", "value": "094e9db638618fa0d2bf4d8460aad3ec07803c4bdebd050fd79e3194e41674a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374531, "uuid": "434bd2b6-a3fb-4b0f-8dba-a0b4eb91a3b9", "comment": "Malware payload (Dridex)", "value": "e0e36ae210a2284508b0da9bd3db6fcc6871ac06", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374531, "uuid": "6b2205d1-32bf-4c86-89a5-efa1c3543d86", "comment": "Malware payload (Dridex)", "value": "bd9a4978b18fb1103f181d60d97757cc3896fb644dc5dccb1fe2c51bfd544ccde6627dae14712f366c7ecc2fd87b9740", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374531, "uuid": "678f424b-d69c-46f5-9678-f7ded2d28a68", "value": "B8F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374531, "uuid": "0895d0c7-c5f0-4e2e-9f43-f1d012dc3bc6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374531, "uuid": "2be5ce48-3f11-48ce-9ec3-6e58eee3c57e", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374531, "uuid": "9409bec7-fa86-4ae3-bf51-34c777b1105f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374531, "uuid": "a1192bf6-475d-4af9-80de-3a3008238d34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374531, "uuid": "2f3f839c-c3e9-46b2-a046-b4b4ffc9058d", "value": "7a109c50_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1e26b1-aef1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620363644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363644, "uuid": "19472292-3f5f-4653-80b0-3ad3ef9202ba", "comment": "Malware payload (Dridex)", "value": "27b1f3f1d4e343159d02b8d84721149c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363644, "uuid": "a3cdcdc4-5078-49ed-9e12-8bc30243c571", "comment": "Malware payload (Dridex)", "value": "09aa8fb0c6dbaf682d22e31ab37bdc737b59d77e1aab999fd32bcf753cba1ed9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363644, "uuid": "f2e3c078-c70e-4ec6-98b0-62aa3765e431", "comment": "Malware payload (Dridex)", "value": "3e38953cbe183df35a917d29a57fb97536249a2e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363644, "uuid": "2043cfeb-0f39-46f6-a419-53c9358b2ac7", "comment": "Malware payload (Dridex)", "value": "11b5df1215471cee8aa2fb131eac357b354ef1b6c7ba75dedfc9391e553e83c9a0b94b1e41a8a08baf1afd54d1f68b6e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363644, "uuid": "67e83e17-b4de-446c-b819-3e2bed4e37fd", "value": "C4F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363644, "uuid": "c97d4ac7-1a50-4391-836e-eec10a0eb1f4", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363644, "uuid": "bf0df771-563c-40d0-9aaa-d44537ce0ffc", "value": "3072:0iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:3eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620363644, "uuid": "ff70477c-5811-4f3a-8210-e500a6bc5aab", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620363644, "uuid": "4ed615fa-d803-490a-98c8-620c6779184b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363644, "uuid": "caa3651f-fa23-4252-9a01-e40c6528109e", "value": "27b1f3f1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5d3316-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407475, "uuid": "36ceb182-efbb-4c42-a811-9c4585c156b7", "comment": "Malware payload (Dridex)", "value": "5a9aa0fbb628cdd2019291d33f4c09a6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407475, "uuid": "044f9e81-7fa6-407a-b950-e3bd7cff73d9", "comment": "Malware payload (Dridex)", "value": "09d2b956ba4f9f2ab7afc4f23a8ff4ddd16639ac9c0ecb0136997f8c0b2fddce", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407475, "uuid": "a511f987-2bde-439e-a702-312e80a5bde1", "comment": "Malware payload (Dridex)", "value": "a7ece5474487d1e87ccbfae266872e609980ee97", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407475, "uuid": "ce146864-a5d9-4d74-b7a0-b8e317ec8b34", "comment": "Malware payload (Dridex)", "value": "6045ae91b2f96e2b126226d1da023a2e34d4a02f58eb7081f82e5dbebe1ca93b2600c89dc211b09ea8b18acaee8f55b1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407475, "uuid": "139c4dc5-0131-4716-a9a4-de7ba5b5d4d7", "value": "9BF3D080E78ED5E0FC075B333E680EEF52310087691954E4EF29DABDD5BB7E15164614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407475, "uuid": "ac646ce2-cc2f-4aed-bd54-08fd7b3abf02", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407475, "uuid": "88db9c76-4644-464d-88c6-cb2ea5624627", "value": "3072:dBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHj8:TuXLcclWEc2HeSjNjGdeD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407475, "uuid": "8649b386-9255-4b94-ac17-2b0e48ba7e6d", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407475, "uuid": "63efbbc9-535d-4296-a749-2a9c1c955ccb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407475, "uuid": "4a5d65f8-13fb-4330-94bc-765d30464356", "value": "5a9aa0fb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583d44a7-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620392491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392491, "uuid": "c4a88c91-7f6e-4075-92c4-b5befefcbd5a", "comment": "Malware payload (Dridex)", "value": "653e29024f36b9d24561edd16bd5d9bb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392491, "uuid": "9417d3de-f840-45fc-bc73-a88588d4d932", "comment": "Malware payload (Dridex)", "value": "09f2e092c8ff9f9c446f3f7b338641b35d0279eaecebe430a2e2252578fb280a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392491, "uuid": "9a3e336b-6620-4ae4-b6a5-bb5b01610611", "comment": "Malware payload (Dridex)", "value": "d6b5e75500331ae58908d9cc9be3fa8a928e9247", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392491, "uuid": "9da0b178-f1f0-4f86-8f4c-ae763c8577e7", "comment": "Malware payload (Dridex)", "value": "62488621db6970203109e3fb490b6fcaf9e297601942f5b48b1f778eca2fd36569b9741ddb8c773d4b8281f3068204a0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392491, "uuid": "67b7ae07-4307-4389-919e-dee010bbae89", "value": "F6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392491, "uuid": "317c7419-631f-4638-933a-f227131ac805", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392491, "uuid": "5efa0693-57cc-4818-b1a7-0d11ab5cdf05", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392491, "uuid": "c31d0adf-b6e9-4766-aefa-ed7b8cd02cf9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392491, "uuid": "b0720969-ea3f-436f-a177-c4dd1304f6ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392491, "uuid": "3696aefb-b8ea-4433-bb82-aa62384b0dcd", "value": "653e2902_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89b2963-aee8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620360065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360065, "uuid": "07d39e55-09a2-4649-9a90-015154289093", "comment": "Malware payload (Dridex)", "value": "fbc68023be0d8000a940a6b602b65742", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360065, "uuid": "d61969d5-11db-4159-8c33-91b99e72e6a3", "comment": "Malware payload (Dridex)", "value": "0abc0b98223a285303a8749ff1d424224ebd091120bd08022060953d6fb4d4e0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360065, "uuid": "c012b15e-88a3-45b6-8277-7c4a294f3e25", "comment": "Malware payload (Dridex)", "value": "9e6417b10c3d869ceb1dc9b8e205181951ede844", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360065, "uuid": "b3c4f8c5-4d68-494a-ad2c-7c9a8e1b5ed5", "comment": "Malware payload (Dridex)", "value": "27fec6e9ae2af3b47f0410600e70f007582dca5cffb34e9a6075f5cccad9689aa378848137e49d521e5ffccdcfc1fb1e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360065, "uuid": "0a6fb9fa-3435-49fe-831c-ce7a15058540", "value": "97F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360065, "uuid": "16a28a63-266f-4fcb-87cd-edfbf5f2bef5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360065, "uuid": "890ba882-9619-40a0-b038-1a9995d0a93b", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620360065, "uuid": "b88ea4fa-d867-49ec-b59c-9802aff18893", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620360065, "uuid": "88d9fb19-8bdf-43c8-96fe-395695e75898", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360065, "uuid": "96859d87-4eb5-48c9-bc8b-61d6439f2d8b", "value": "fbc68023_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c60f39-af6f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620417727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417727, "uuid": "822e8835-184a-4c8a-9883-9787eedb98ee", "comment": "Malware payload (Dridex)", "value": "cd1ea65bf4fc0a00ca9fb19780ecad2e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417727, "uuid": "f6f386cd-cf38-41ab-8531-6d3839a313aa", "comment": "Malware payload (Dridex)", "value": "0b1b14bac9487571009562faa4ea21e7e7a6a4fa475706de0f5bfcc7c42d1b2f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417727, "uuid": "a6b7a61b-ca46-4ba2-9587-6c336ca981c5", "comment": "Malware payload (Dridex)", "value": "e235e3c9952a587a050e33821ed2b37a0f974a30", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417727, "uuid": "e4f803d7-da2f-47d8-b074-2da258a014e5", "comment": "Malware payload (Dridex)", "value": "58557b2eca69583685822ad85fc77868780f6310ddc11a48e7d9237d6ee245e0914c975a4fa0fb23464b075df6fa33a6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417727, "uuid": "14b181e3-8dc3-4926-af5d-cbc1b7c75067", "value": "59F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417727, "uuid": "48845b36-173d-4cc7-87ab-b8db84150171", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417727, "uuid": "a8da16b5-a9d7-4c64-b05b-f8d8c84f643b", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620417727, "uuid": "0d7546e3-a420-4285-b65d-795a0944e2a8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620417727, "uuid": "f9bd93a4-5b1a-4f27-8369-b0047db3b97d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417727, "uuid": "21b7af8b-3479-42db-80bb-1d78a58ef102", "value": "cd1ea65b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55aec461-aef1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620363711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363711, "uuid": "d0d28bd9-85b5-45f1-90f3-d2329fb26581", "comment": "Malware payload (Dridex)", "value": "af7979853e9f574b0e8bf833d38c5937", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363711, "uuid": "2734bb6a-fb96-4e54-a912-0caa486bfa8b", "comment": "Malware payload (Dridex)", "value": "0b412156f9bc2f005aae3741080870c3c1758225c7e03395bad3204f71f99205", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363711, "uuid": "371878da-0b8f-4679-a6ae-7c0201d0a14f", "comment": "Malware payload (Dridex)", "value": "1f8da40184eb34c267f780092ddd68732d149bd6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363711, "uuid": "26028ef8-197e-4cfc-ac69-a31fc9f719cf", "comment": "Malware payload (Dridex)", "value": "1801a38f19545050193cb5ce0afb0c4046924cf2f59a2284b25f28bb01dc3964d179aace2c339a8f4e6f64b44317cd5b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363711, "uuid": "94bfa3f6-56ee-4f3b-ae2c-e23ebb9e1555", "value": "C4F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363711, "uuid": "a10edd27-a1b3-41d1-8456-bdb9c00f85c2", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363711, "uuid": "62489daf-e8f1-4124-95a7-be545fa5b533", "value": "3072:clpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:clo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620363711, "uuid": "22606d69-eefa-4b9f-ada6-2e507659d720", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620363711, "uuid": "34de062d-8fbe-4c83-9486-bbcbed5a770b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363711, "uuid": "473c114d-2e59-40a8-85fe-bd894c590cbf", "value": "af797985_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec297b5-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403535, "uuid": "d9d1c3aa-7880-44e5-b967-900cc010bbbb", "comment": "Malware payload (Dridex)", "value": "0dcd014bd8d6d9ff6be5dadb8728123e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403535, "uuid": "c1e82de4-1bb6-45f7-8c41-f1780754c8b0", "comment": "Malware payload (Dridex)", "value": "0b7aaf729e6fdc0570c0b0c679d6e6251494a59314a51bb2c66fae509c617ed3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403535, "uuid": "00bb3ea7-e363-497b-9665-5519ff175248", "comment": "Malware payload (Dridex)", "value": "69b83aa1d6ec150a04ba0017c680d0dcf05767bc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403535, "uuid": "f2f83a4d-d2aa-4d59-9cf8-088e9c643b64", "comment": "Malware payload (Dridex)", "value": "b4f214ce81a63ffc800b6bebd0c96f94ff9ada7e98bcedd75d895d028fbaa66ae4c8f536c1bf58122c3e4fa59e232765", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403535, "uuid": "5d4d8f68-c9ab-41c5-a1a9-739c761f29b2", "value": "B9F3D081E78ED5E0FC075B333E680EEF52310087691854E4EF29DABD96BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403535, "uuid": "cf4e3139-9a24-4e80-9834-43318262bbb3", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403535, "uuid": "b9b4850a-f0b8-4e1f-bf5b-a2b0676653f2", "value": "3072:ABoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHdC:0uXLcclWEc2HeSjNjGde9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403535, "uuid": "782d6100-db00-4082-a18d-6d8da862dac8", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403535, "uuid": "e14b08e7-f599-4ffe-a1b7-5bc612fdf652", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403535, "uuid": "0f85ec33-8ed0-4f6b-b9db-42737804e6fb", "value": "0dcd014b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2de972-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404282, "uuid": "c6cbbd54-7715-49b8-a51e-c01f836c5f1c", "comment": "Malware payload (Dridex)", "value": "c7ba1137a5b457bb08b53f98e6bc67e3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404282, "uuid": "cba8eb6e-dbc7-4438-8d0b-8064dae55c05", "comment": "Malware payload (Dridex)", "value": "0b8092d13f0801440dfc0678b3a2a993a9733dd1086b5b39331904a20c560dfd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404282, "uuid": "2b0236fc-ab1b-4704-801a-88f851934399", "comment": "Malware payload (Dridex)", "value": "7bde4afb4d6f21b3bd2f07670ffb5622e64a51be", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404282, "uuid": "e4cd5723-4612-45e0-b1ee-6613c268fe4e", "comment": "Malware payload (Dridex)", "value": "d8441b2f3d39de1fff49be521ee8aba038abf8bedf9a3a3952cef9b1d804944f8575d36a3edbdec3fd32845f36e9b405", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404282, "uuid": "bc3c9751-0547-417c-a2f5-3cd43365fdd8", "value": "8DF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404282, "uuid": "c7d16fcc-2fdb-48dd-9ef1-eefa3e4bad0d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404282, "uuid": "76c3c5b7-7120-4e63-ac43-fc3d4f7f40e6", "value": "3072:ZiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:KeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404282, "uuid": "fe66ff55-8af8-4e28-9b93-41f5ef171dff", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404282, "uuid": "1bcc8109-1f8c-4627-93ec-6f2002269bfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404282, "uuid": "72de28ec-d2b4-4c42-acd3-4f286c1b0210", "value": "c7ba1137_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae20406-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner)", "timestamp": 1620392388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392388, "uuid": "cd7e34b3-6d12-47e8-af88-1b54176f7a4e", "comment": "Malware payload (CoinMiner)", "value": "e8450e61f061fd90d74507eb04845ecd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392388, "uuid": "d30a994f-471e-4274-893d-b564e6d99986", "comment": "Malware payload (CoinMiner)", "value": "0bd2014bb1daba436cf1168ca4de9d3784afef3a4141c2305f786da543567c15", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392388, "uuid": "34e3108f-609d-4879-ba2f-b1729983a473", "comment": "Malware payload (CoinMiner)", "value": "f344f20c57f9cb01ea3166f3404336da1519a832", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392388, "uuid": "03184926-d3b8-4db0-95f9-c8f472d1d5d6", "comment": "Malware payload (CoinMiner)", "value": "11b7992b7dda1216c6eae89e84134414086d804bcb1b0e57518a166c7cb30ece77faf29d65f4f83c6beb13c49cdb3cfb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392388, "uuid": "f5e04a21-0ebe-4004-8208-de60456b92d1", "value": "0C9423A0AB0BAA37F42BCB7DA40AA4234BC19E36029F5E75C16D7B77D4965C0D054E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392388, "uuid": "2abf4e3b-8e65-44e3-a145-1c197fe1fa68", "value": "b1acf33ac5d2d07c82422095772ab92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392388, "uuid": "9c9eb3a9-dd09-4136-9f30-902229e2b5aa", "value": "6144:mFQZ4VX6EEUMZBendfee1o856wFaZZUyvmE8h9pzSUCCjQ4TyapB5kzD:xZagkdfI8gwFarUyX69RagPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392388, "uuid": "0f35d572-35b8-4899-a0d9-bedcfab6d8a2", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392388, "uuid": "0d9a8eee-2f0d-4e36-bc4e-11644997c9c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392388, "uuid": "5b134849-825e-4b1a-a8e8-d7cbf9256d41", "value": "tq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052da173-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407384, "uuid": "db84a483-b1e4-4de2-afba-ceb51bd2a170", "comment": "Malware payload (Dridex)", "value": "a278eefac25100edc3681039fede81cc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407384, "uuid": "4b3a4409-593f-4b92-860f-ca0cc7f0326c", "comment": "Malware payload (Dridex)", "value": "0c9b48316f811cca7c0c52c2c11914cc8de0d90959646509c5a536eeed3cbf32", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407384, "uuid": "c21b450f-8623-4ef6-9c75-09a1d6a872c3", "comment": "Malware payload (Dridex)", "value": "4e38b5ed7a1c7b8e5fdb65e50854c61acb9f7f05", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407384, "uuid": "51a0edd1-3160-41b3-94ad-463efe181047", "comment": "Malware payload (Dridex)", "value": "82270e82fbf64a037efab0d314c43c7ff8e8c0bdd2e910d54827104c09296000196aec968e23f6fbcba0df6f34f25b20", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407384, "uuid": "79655a0c-3eb4-4d3f-bb95-080d13966345", "value": "0FF3D081E78ED5E0FC075B333EA80EEF52710087691854E4EF29DABDD6BB7E051A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407384, "uuid": "acb38895-5db5-4653-866a-fdee1c8c2f50", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407384, "uuid": "f17e5ef5-473e-471c-a232-d2f159237d1f", "value": "3072:CBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHVR:CuXLcclWEc2HeSjNjGde1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407384, "uuid": "33d7f069-0401-45b0-bbd8-00ff268ba5b1", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407384, "uuid": "d37962d1-7674-47f3-b014-39f5557843f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407384, "uuid": "d8e4c211-52bc-4763-8efc-1d550ccb8227", "value": "a278eefa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10835e37-af88-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620428449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428449, "uuid": "859fcd61-40fc-4e41-834f-63304483ebcf", "comment": "Malware payload (Dridex)", "value": "999e992c1bce3f5556f483c8bfb056f1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428449, "uuid": "5c5242ce-d47e-4a62-a927-e6eae88ddd07", "comment": "Malware payload (Dridex)", "value": "0cc61c5cd2395568b140f82867c22b3e1f896f6e14452bd1475048b18266b720", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428449, "uuid": "e90d68e9-d0e4-4fc2-8ae4-61e7ec028ebd", "comment": "Malware payload (Dridex)", "value": "ca826aba19eb392540039e48b78f432cbbc9c8a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428449, "uuid": "7a3a7072-97a8-4d1d-8932-640cdba91170", "comment": "Malware payload (Dridex)", "value": "db7a67aaf1331cba033783e0dc83378167538eba4abf6117c498153b40fd5fcf3dd6c5680d843eec226c0f542325ebe5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428449, "uuid": "3f216620-629c-45cf-b0bc-f623df89e8ce", "value": "D5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428449, "uuid": "46ec27c1-08e2-4713-941d-dcf10c42322c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428449, "uuid": "1986d271-15d1-497b-b500-12a2429ed2e9", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620428449, "uuid": "04f07096-786b-4e88-ab38-378afeef88ad", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620428449, "uuid": "bb81df25-f0b1-45da-9ddf-77c3e7ee9d43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428449, "uuid": "dbcd719a-62ca-4b17-a240-f83cbc7493f3", "value": "999e992c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee5df50-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392207, "uuid": "579e5608-de73-4fc5-8679-fdb119b63ac0", "comment": "Malware payload", "value": "efd1323003076603c9325b79b568cf5c", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392207, "uuid": "b4bb1217-4503-48c8-955e-63902ecb12cd", "comment": "Malware payload", "value": "0d2f4a4c7435977be8acfc012071753815a6712ec2cde4b334740e417320286b", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392207, "uuid": "791a3de1-6d0c-41ea-9b7e-67312441f5e5", "comment": "Malware payload", "value": "08c4e4a80b661b442f58cb9adb8e95079def01d7", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392207, "uuid": "d741cf1f-2e3f-4b71-904d-f0666d8b9ade", "comment": "Malware payload", "value": "d55d944a4f7af5c6babc2ac628ad77e483ef9b76109243d8c71a4a449b12dd09b9c2ee27316193943fb59b062b37c9dc", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392207, "uuid": "a5269f8a-31cb-4132-a6af-51f1bfe036c5", "value": "95A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392207, "uuid": "6709e942-32d1-4dd9-b69b-5422b9f1b82b", "value": "96:OLRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:OLRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392207, "uuid": "93a425eb-6e35-4d43-a57b-2a8146afeade", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392207, "uuid": "383cfb59-8f49-48a9-b46b-32ce1acc85e8", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392207, "uuid": "a21fed2e-c38b-459e-a609-b13bb125849c", "value": "0d2f4a4c7435977be8acfc012071753815a6712ec2cde4b334740e417320286b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11e85d6-af24-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620385849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385849, "uuid": "13a83ae5-3b1f-4106-817a-70a71703b6d4", "comment": "Malware payload", "value": "1714bb75ce5f5626d6d888a387e29187", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385849, "uuid": "ce3eefd5-78f3-4253-9129-814394bedeb8", "comment": "Malware payload", "value": "0d6f7ba2d1ee7054fe5147fc81268aecef2c5a6dc809e61040f0df84f29a5bee", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385849, "uuid": "a40c69f6-93c6-4874-b06e-17ab54bf3b30", "comment": "Malware payload", "value": "27705de8e0aea3cdb8c07b299a5fe10f9dfb381b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385849, "uuid": "cf829958-3748-4c6a-ada3-4e1efb563b48", "comment": "Malware payload", "value": "0058ff0af196264a4db2ab6114922ce9842f18050aea5452b9bb3b158d11689b409e462eee99dd4bb6adcd1b164ec585", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385849, "uuid": "2ee834c2-645f-4f60-9f14-4095fcb3e3b5", "value": "C305483D1194ED26C0E8A1360614E333CA69A82D5FBD9ECC1B87D654C56E232CEB1F5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385849, "uuid": "e64ff264-14c9-49f7-8c86-992e52bcad4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385849, "uuid": "bdc5fe75-6141-4b0a-9573-bdf79dc70ccc", "value": "6144:nTy46PsNNDFRklGF+sNNDFRklGFynC1FTy466WwlgggggK77777770EiHTy46:nx6k/R/yCrx664Hx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385849, "uuid": "f349037f-fbaa-4a84-9150-7010d297e572", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385849, "uuid": "cccf14de-8060-44e2-b531-786f20fdb7a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385849, "uuid": "01c8aafd-cb36-4396-9397-017c758e5c8e", "value": "coinpot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1504c3f7-af88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620428456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428456, "uuid": "cdafbb52-c191-4bac-9a4b-04ee087e75e6", "comment": "Malware payload", "value": "284d7991e35f723b800445f3e016838f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428456, "uuid": "85b1ca04-3821-48cd-8e86-9c746646c51b", "comment": "Malware payload", "value": "0da2c32d16cecbd508bc325168c8042b0227179906c907d0778e59f4f662db1f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428456, "uuid": "bfd656a8-360c-4395-862e-9442f1a43c5c", "comment": "Malware payload", "value": "2833cdba10903310029cd65bbc184e3c38c9f0fd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428456, "uuid": "8dc08612-6fc9-4db2-9f79-2762244010ec", "comment": "Malware payload", "value": "0344f005902459a0ed8cc7b1cfd84e310ac1b73ea4a80f2f11a4a066cd7cf9f9f4338e7b08b22fca101d657d109612ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428456, "uuid": "39168a10-e5c0-4eb5-9409-de3fb55186c4", "value": "A9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428456, "uuid": "88436532-aadb-4a70-ac58-f9b0a420dce9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428456, "uuid": "dd02cc31-b0b7-43d4-8bef-c3fad456bf5b", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620428456, "uuid": "407838a7-0b2a-46b7-aa5f-42bd8093c67d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620428456, "uuid": "74638750-6bc9-4ffe-a6b1-97308049353b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428456, "uuid": "7ab8b37a-2daa-4cf2-bdc5-339c9ea71f7a", "value": "284d7991_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f35b9b6-af77-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620421252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421252, "uuid": "5641bf9c-c470-4666-8b6d-242078a2b6e6", "comment": "Malware payload", "value": "d7a41869ac17909fc3635e9992fd3de6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421252, "uuid": "3aa4cfaf-be04-413c-8823-d184070ea5e5", "comment": "Malware payload", "value": "0ddeae437bb7455d2232a558c1042f1160e094ff02361f5564f65024b041a4cb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421252, "uuid": "3e78ab15-4f92-4d34-8939-b613adbb069c", "comment": "Malware payload", "value": "38ab70e2e28c6075709a5b08ba74a04e209dc820", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421252, "uuid": "e437744c-b433-4c24-aa69-fc3d1503adbc", "comment": "Malware payload", "value": "b328ae6c15bbb74c933c8aa4623eee71be18833e8360e6415c44c7b5cf0989d88c4ee73f0b2ba56b1dfc861d9bb6b03c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421252, "uuid": "d8c7696c-e095-4884-9756-611d340ccbdc", "value": "1BF3C141C9C5CCF0CBE36C364695963B3328B541995A8E42EC24CE2FA15F3F1F95A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421252, "uuid": "085cb75b-77e6-4525-9a5f-905ea8b93a29", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421252, "uuid": "52de9f6a-0d2c-458a-8910-1379cd6279b8", "value": "3072:WuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+ii:W0czbty9uiaJlbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620421252, "uuid": "52f0228f-a702-462b-855d-5ae61e48f603", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620421252, "uuid": "211e47a0-9486-4284-94d9-eb8572bf6ba4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421252, "uuid": "38cb83e9-bcd1-4e57-bab9-94c89a56fad0", "value": "d7a41869_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2c459f-af43-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1620398811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620398811, "uuid": "72183676-9372-4c85-afba-3ec8357aa035", "comment": "Malware payload (Vjw0rm)", "value": "29805cb77711c2d3ce8f364ade7996d6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620398811, "uuid": "c1764d79-6de9-48a2-80fb-9a3695936792", "comment": "Malware payload (Vjw0rm)", "value": "0ddfa19149e6fe2a1a8357b7019d5c2debcea3d5abd6739c0a9c16a989785a4a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620398811, "uuid": "2326eb2a-f270-4202-aa9a-3306a9ad0f6a", "comment": "Malware payload (Vjw0rm)", "value": "d22674b1971799ed5c5cbc54fd5b14de98ac1d96", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620398811, "uuid": "64cf9bd5-fc55-452e-b6e0-d701d2ff07ad", "comment": "Malware payload (Vjw0rm)", "value": "ca54f4fb2895cf05c934f26a9bb43a740cee5e691d2c04a25181bdac6cac7816329581e4a9ef31d5d200b2ecfed43706", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620398811, "uuid": "a48f375e-558d-44d5-ba9f-40f81adda92c", "value": "FA81229D2C4B863C53D23B8A802ED14CCDF548B47F28D2B6148DDAC5360E97987B59BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620398811, "uuid": "eebfa6d2-d967-4b2b-86d6-68bea2e5507a", "value": "96:SABNo5DDk2c24ZRMHXE6/BIsl+Ys+fJCDdQqR7bJyKhXKOS4UK:zSM2c24ZRMlBIswYs+fJwfRfx9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620398811, "uuid": "33d02fa4-3215-4228-a286-27a4f656dc6d", "value": 3879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620398811, "uuid": "b0a840c7-c11f-4b04-be50-9c8a7376401c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620398811, "uuid": "f438dce6-cf56-4b69-924e-7a97bf9b0bc8", "value": "Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a7b079-aec7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620345650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345650, "uuid": "bbcabc97-0c84-4ba2-bb39-291e3bf76e0d", "comment": "Malware payload (Dridex)", "value": "d6673c37334cb9fcc52e24723a77c2d7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345650, "uuid": "80a6b187-5dbc-4447-b106-49aa067722ae", "comment": "Malware payload (Dridex)", "value": "0e13f50ef72e2c7c071aacadcd794e325e1686ca7dcbf3a35dcdebe7055aa71e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345650, "uuid": "12953ba3-54a4-446f-ad44-bc5b2e3cd47b", "comment": "Malware payload (Dridex)", "value": "7fec1dd5248e84e6cc73e28ce0b7025e78b46c87", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345650, "uuid": "75f03366-c539-4bf6-b96b-34c30227897d", "comment": "Malware payload (Dridex)", "value": "863e04ce42e7e641db042ef7ef18aa063bcc0037f5e7bdcc0cbdd5edd624cabd61cf1299e59c683f26585a8e2da373bd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345650, "uuid": "8ecc9fd0-0b9b-4d98-8e81-059e3d67fdee", "value": "2DF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345650, "uuid": "dcf4d74f-390a-45ff-9b63-365a93342048", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345650, "uuid": "2f833a39-6cf7-4480-8a5e-8f0df4753f32", "value": "3072:XWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:X42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620345650, "uuid": "cd7037f3-2564-4135-9eb4-6ab534af9e47", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620345650, "uuid": "46092605-ca9f-4d37-9af1-3556416ca10a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345650, "uuid": "5cc718fe-e2d0-4b63-a27d-34b11762250a", "value": "d6673c37_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b9211f-af5e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620410504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410504, "uuid": "43854d5d-bbf2-46a4-8d4a-b85c5fa28ca9", "comment": "Malware payload (Dridex)", "value": "973a5c545d5af80e15e8ac73f654dda7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410504, "uuid": "22b4b00c-c1bb-4c71-98aa-120771156ede", "comment": "Malware payload (Dridex)", "value": "0e4521244dfbe292b5909cfe1dee3a507467344501e3a525c2ea32be61db826d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410504, "uuid": "0fc9c8ab-bcfa-481e-8c68-450079b54b58", "comment": "Malware payload (Dridex)", "value": "105626d5432959652288b54020adeb40dc44a11b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410504, "uuid": "2bc7766d-1cd0-4441-84dd-3a272cf541d2", "comment": "Malware payload (Dridex)", "value": "a84256b4928f7d5be1fc4d5913ea8ce8a6f0de0ada3baef993f9f54401403b2b9d52e0dcf8466c1d6377f10ce2796587", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410504, "uuid": "35899659-1497-4460-b3d4-963f7d890ad1", "value": "17F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410504, "uuid": "4377af20-38ad-484c-b981-8ba6593f7f7c", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410504, "uuid": "6396e115-99bf-4b15-9dbd-5089d3353b7d", "value": "3072:NA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:N3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620410504, "uuid": "566357b9-95e0-4292-87c1-65096bd2d16c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620410504, "uuid": "effcdae1-5aa3-4262-bd93-94214bc4517c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410504, "uuid": "c4507cf7-86d8-4907-acfa-72466dab995a", "value": "973a5c54_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1855b3-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner)", "timestamp": 1620392337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392337, "uuid": "8069b1bd-6e6d-4c42-975b-51efa2536f61", "comment": "Malware payload (CoinMiner)", "value": "36ea032886448b2a1e55a93594c1eba3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392337, "uuid": "0174d298-7551-46d3-a55f-f2df9d8e1910", "comment": "Malware payload (CoinMiner)", "value": "0e8fe646dfc58cda3a87d1d236a72708b268878ecf78d7dc77443c6814d66145", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392337, "uuid": "b09b11bd-9420-440c-b70e-7cb807dddd43", "comment": "Malware payload (CoinMiner)", "value": "9a9c0c66a5a7bbedaf75e3a09670f0307674419b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392337, "uuid": "eafc2945-69da-4578-8119-2aac34729446", "comment": "Malware payload (CoinMiner)", "value": "fb20042cdf762acca50234481935b4425bdb8feee202a0e0be1b1481941a3826acadb9aaf0155399d4997a56a220570f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392337, "uuid": "c6907ae4-c543-4896-b373-b35919ffe729", "value": "64D5BF272C4DBD8DF9837AF91D977689A860FC24F46C069324C1B915D439393A0B73AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392337, "uuid": "0c078c21-fc46-4a18-a7d7-bfa3670cd4b9", "value": "43257f99e27817b11e6f7e4681310827", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392337, "uuid": "37270e88-6617-41ba-a15b-ec715327fbb5", "value": "49152:DWQq/Id0dpFEjZFgwa0aTuyDAkD4qfFqlYCd6/0ihTFjKiq2:i5IdoFKAhHcCqJ47hTBKiq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392337, "uuid": "8cfe2a17-bad9-4b5d-9ed4-d5d64fb5c229", "value": 2909897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392337, "uuid": "9b9a6300-6797-4819-9357-7891bc6738db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392337, "uuid": "1a1d2afb-abe4-40e6-a25a-56772335d258", "value": "notepad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14f372e-aed8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620353181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620353181, "uuid": "ad364ef8-9e1f-4a8c-8363-85e88e182e96", "comment": "Malware payload (Loki)", "value": "3d771f94fe4398fb5f8f2c8171737486", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620353181, "uuid": "9a1426f6-cc02-467e-b264-20430d018c4e", "comment": "Malware payload (Loki)", "value": "0f03a7c3c1a4ae6ac045a9ada32a24fe142d0943dee1e994e60e4c4869f238d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620353181, "uuid": "9670ec4b-8f53-4efd-a7f9-8b7599cc8d40", "comment": "Malware payload (Loki)", "value": "9d2d8eb5bd7a45a3a25ed0c8b517802575e2abf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620353181, "uuid": "e57fe9d6-55d7-4eaf-b4ad-1a1ad2ea4d42", "comment": "Malware payload (Loki)", "value": "85837a7f30edffb1aaea9d9f83f6d6b8cfc84bda6957f3a1412a3edd4400def264ac0341062790281649bd995bb7f141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620353181, "uuid": "5ad3aefd-ebb6-4e95-aec6-9187e898dca3", "value": "85749D2A7E49C03EC454C8BCD6398282BD56C29B51ACFACDC1D544ACB1127D7BA2F93C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620353181, "uuid": "41ba4b89-7f5a-4831-950d-ebea14165fdb", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620353181, "uuid": "eb7ce5ed-77ea-45f1-bfc0-494cdac116b1", "value": "3072:Vf1BDZ0kVB67Duw9AMcVbZLHf4sSiGh7VUooQcU9cl7DBzgAVynYDXAR8HA/Dp:V9X0GxVfVSiwVU1QcU9cl7Dny6XARFrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620353181, "uuid": "bcdcecc1-0895-41e6-ac6d-6644b940dfe3", "value": 365956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620353181, "uuid": "2a39e0c0-2d31-4668-a845-da5fc574437b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620353181, "uuid": "9ac9eae2-e97e-4123-831b-64dce802bf14", "value": "Request for Quote 06-05-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11350db-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407324, "uuid": "cbd41c8b-7643-4cd5-bc35-b944f1443ed5", "comment": "Malware payload (Dridex)", "value": "3b7d48fde568f9703b69eac3f94fafb1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407324, "uuid": "37860ae5-1e13-42eb-a84c-f10ded9bbc15", "comment": "Malware payload (Dridex)", "value": "0f855c05bd133d0adf16592ea7d98f1d4c740382ace4855e7ec3b16a8478dc87", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407324, "uuid": "d96cfa99-4e82-433b-b2f4-9c8afd7b1eda", "comment": "Malware payload (Dridex)", "value": "1d012aa49e177b85d01944200b17cc1ef3811821", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407324, "uuid": "8886c057-97f7-46c6-8aac-469721cbfd2f", "comment": "Malware payload (Dridex)", "value": "fe159f05320c614fc155fc4bbc7d3a38d0a74dd01f72753cb814caab1537b5152cd664a9bdb736701be9327422d5d679", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407324, "uuid": "05dcff7d-b7fd-493e-977d-59c94096a08e", "value": "17F3D081E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E051A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407324, "uuid": "61cfdc62-feb3-404f-bee6-46440ea5e3c1", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407324, "uuid": "27c660ed-9353-46b2-a8d4-884092130f61", "value": "3072:lBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHRX:LuXLcclWEc2HeSjNjGdexX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407324, "uuid": "7f013c7d-28e4-46a0-b04b-a15619372064", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407324, "uuid": "8422885a-ff09-401f-b042-dd9d8709f709", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407324, "uuid": "8c91c30b-4df0-4e98-a0b4-c006260e151f", "value": "3b7d48fd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab634572-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner)", "timestamp": 1620392201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392201, "uuid": "dcf8c1c2-cabd-453a-a8e2-2486262b7d49", "comment": "Malware payload (CoinMiner)", "value": "2a8053b9d54341d3034b16e41c42885f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392201, "uuid": "7017520d-89e2-4ba2-b7f8-d4fd2c79c38e", "comment": "Malware payload (CoinMiner)", "value": "0fb3b99e498638894f8a39cb9235108012e6820afb9f96dee7de733f7095f4ef", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392201, "uuid": "4f33f4f2-8782-456d-97ff-aad75ec45794", "comment": "Malware payload (CoinMiner)", "value": "d7f4188ce05d608cbbe5960b01cc2429351ae607", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392201, "uuid": "7abd5adb-c331-4117-a791-ceb8c1d632e8", "comment": "Malware payload (CoinMiner)", "value": "a0da46192b1ebf25e7dedba51f5c734eea4493f6bdd18b57fc1de527aa08f052551287cb01e08dc6f317058a837ae5e7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392201, "uuid": "a047b908-c273-4d17-9b08-2020a5c6dc92", "value": "D3A512D536A8E9B2D81F9CF1D4FB0E135A427893CDC6056E1AC1FB95C46A8935823E0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392201, "uuid": "ef74a119-75bd-44f1-94b0-68c2329c2e5a", "value": "49152:udsvs+5R1oUNRJ51lx/dfW/6m4z+vXv/1Ay755ObSNl0GkY6:hU61lDJVhdOK+v/2ULOg4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392201, "uuid": "8993a032-73ec-4923-969e-893d752840d0", "value": 2258432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392201, "uuid": "4314be2f-5ace-469a-afee-07717117d9db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392201, "uuid": "071c5dd7-c3a3-46b4-8a9e-3f53e0836b5f", "value": "activation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c036e2b9-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620414141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414141, "uuid": "a34e220f-d52e-40eb-9bd6-fd21b32ecdc8", "comment": "Malware payload", "value": "b8fe6529b283649e10101af154772018", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414141, "uuid": "b6e89ca5-f54d-47a1-96aa-0cf83e496a59", "comment": "Malware payload", "value": "1016ef2316ea1fa97ef9c8942743dd4d5cc79eeeae4c549fd4e58eafe088bead", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414141, "uuid": "fbc83ecd-4806-454e-9bee-c61ee2969935", "comment": "Malware payload", "value": "8212f58e1cfbdde45d9dda3b6dbd20c152b096aa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414141, "uuid": "790dccfc-8ebf-44fe-be68-35f87dcf1226", "comment": "Malware payload", "value": "9221042b33ad3b58a38f16151f68f28dd58987a3496a641e82371223405340e95ce60bc178ccbc3e6081e12557ac1815", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414141, "uuid": "fd49653c-7519-4707-a8e7-c35d4ac7dc05", "value": "50C4232C4E35AF8EEDA4D84652AD3CD24D77B4BA9CD3294D53809DC23A4ECEC4662F11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414141, "uuid": "ee8cf582-5883-4165-b37f-603d76f34aec", "value": "12288:bHaPZBSQRwL032gcQPYotLbsbMQLor3geHjbva:GP2EwdYXLbsXsbjbva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414141, "uuid": "ca71811d-8d9e-4ebe-bc8a-a955abdf4f4d", "value": 545328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414141, "uuid": "a9d5e193-d848-45a1-831e-1243994a9e53", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414141, "uuid": "6018bf15-73ef-4ed8-ac80-1eab72d5ec46", "value": "b8fe6529_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9598ec62-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620385293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385293, "uuid": "e0b2c6af-5228-4b49-9170-2d47dd0b9936", "comment": "Malware payload", "value": "03abedd54bae86de91c0514b216e4c82", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385293, "uuid": "a98740e2-5ec3-4f0c-9a0f-ebeef9ffcf18", "comment": "Malware payload", "value": "1059e8879dc495dd2239beba0b3533165ffebcab8dd5d194f32cbfa4c200752d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385293, "uuid": "0dda9dfb-99bb-4651-b551-603e78eef777", "comment": "Malware payload", "value": "ec656486b06e821a10a28e252ede610c45ebbd4c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385293, "uuid": "2a3df0c7-9da8-472b-bec5-cde33d3fcf1c", "comment": "Malware payload", "value": "3fe0eb19515c24a8cb5e7e61965e6e75c5cc2145324cbc41bad79905eb28e950638fedc9e1ee4386f024278642801d97", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385293, "uuid": "6dcc6080-d3b5-463c-8523-840b98c769fe", "value": "0A862303E4907862E0A61AF00BFCC67767AA6CD20BD457BB52F80F573A542D06E396D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385293, "uuid": "af0ac6a9-ebcb-4a6d-98f5-4ad1d7147a02", "value": "38cec625fecfa77d86b81445b2b79675", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385293, "uuid": "2370cd56-00e1-4a4b-976c-11304152d128", "value": "196608:ciH6/6H0fbpSzZTfu6Is40qltClxXvshEeIk:jG6UwzZfnIsucl5vs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385293, "uuid": "6f25c861-67e3-4676-8600-1fe09e6df4ce", "value": 7901112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385293, "uuid": "88ff92a3-c927-4e3b-8ca1-2643955bbce8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385293, "uuid": "f2efc146-143a-486d-aaba-197dbf1c1e83", "value": "03abedd5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584fee62-af35-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392921, "uuid": "bdef6390-aa96-4419-822b-c585c59fcb75", "comment": "Malware payload", "value": "7d507a0cee886616ac179eda70230e87", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392921, "uuid": "4b0257f8-c9a3-4318-b116-cabb14a064f7", "comment": "Malware payload", "value": "109f03e684116cd4f4d2b33a1770e32478cce9409fc3c92793f38828c897dda4", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392921, "uuid": "2ae4a3f8-5095-4cd8-95ae-4357ea196187", "comment": "Malware payload", "value": "9b56e0475db3978d7b68435f1f804f63b52271b6", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392921, "uuid": "f27f6064-3a1b-444f-9dea-e3484871ace3", "comment": "Malware payload", "value": "49366c92ee1bdfff03008df4fbde82bac95caea71849f2e6a3a9ba963c0474caa14580f428869b3aea6da384b647fafe", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392921, "uuid": "c243209f-e0b9-48ee-94d9-326800daa224", "value": "9A63F7753845F2A8D5E88078F4432EE92D5209283EDCD1E76483143BFF70B89B66DE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392921, "uuid": "7decb683-f818-4abe-86ac-ef521a7bf6a4", "value": "1536:lvRY/fzqbw/Rh7HuKn8+VBIVCCfy0K9sgBv:Pbw//HrFuf6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392921, "uuid": "64dcd59b-b97e-415e-9b39-68162aa28469", "value": 66944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392921, "uuid": "6e4d3ffd-378d-42b2-be36-43ffdc947766", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392921, "uuid": "254a0df8-1212-45d8-bd58-2809aeeb7c41", "value": "94VG.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a8e58c-af20-11eb-abe1-42010a9c0039", "comment": "Malware payload (LimeRAT)", "timestamp": 1620383818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620383818, "uuid": "bc9ef4e2-5725-4860-8212-4a06b59e6a72", "comment": "Malware payload (LimeRAT)", "value": "e04ed1d1bfb04cb9a47a2f8b23613d3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620383818, "uuid": "12481ef6-9f5b-4e25-b78a-acce427bf0a3", "comment": "Malware payload (LimeRAT)", "value": "10a30b9776bb8981976fe678e4538e68c8fbbb0a57f34934978b3df7238be8d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620383818, "uuid": "f73676e0-d261-4334-bc9c-c2f6b90fc6dc", "comment": "Malware payload (LimeRAT)", "value": "294287a158af747c67c2d12d2359c8968ca5bdfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620383818, "uuid": "6529e7a1-c79d-49cc-ab9a-56b1dcfab5d4", "comment": "Malware payload (LimeRAT)", "value": "da4b649af04f735160e22ac01073f7fa7f2e4d6095d792e48f8e2949350f5d0ebcb481eafaa02bb2acae75749a9f34e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620383818, "uuid": "306c6d45-cfc4-4f23-946b-21a3d0522be5", "value": "D5C4B2D2619D1195C029F5EAEAB3FA627952BC5ACFF14C14893A301D9EF1603EDE8C4C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620383818, "uuid": "e7c500ef-18b6-4af3-a6b6-df25348aa433", "value": "4d17be67c8d0394c5c1b8e725359ed89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620383818, "uuid": "f4c9d89b-b68e-4f6a-ba81-cddca3c65fb2", "value": "3072:6KDAfCDSmJVq8XPdnWlef4krww9aqeaYd/IWiD2BQAMnxZwzwxcwY8puRH:6RP8/dmef4k8FqeaYamBQnxZFc+uRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620383818, "uuid": "15d6a4ac-ec7c-4a92-818b-041c75c510d9", "value": 550071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620383818, "uuid": "1fc699be-aea6-461d-a983-70c0bf959252", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620383818, "uuid": "89c33986-7a37-48dd-be59-a0404b905e3f", "value": "10A30B9776BB8981976FE678E4538E68C8FBBB0A57F34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc7bcbf-aef9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620367244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367244, "uuid": "4f95f243-9a74-4f78-a70d-88ac16909ae0", "comment": "Malware payload (Dridex)", "value": "9c7268032a80d65ce267f803bf12b653", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367244, "uuid": "84ff3bdb-2121-4c4d-8d7f-54edaf1a7cce", "comment": "Malware payload (Dridex)", "value": "10c947c31a947e96dc72c37df551a876e4acfc44a8e26ffb9215679bcd2b37aa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367244, "uuid": "ef7a402c-11fd-4fb8-ae58-87a2bb62d4a6", "comment": "Malware payload (Dridex)", "value": "bc1a2b5891199f532ec9a43bf47aa81914f4aaee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367244, "uuid": "35d002ca-92f5-4ec1-b2e2-ebbf8e005da9", "comment": "Malware payload (Dridex)", "value": "2ecdd874340df04124117826eb5086514edff5c21c1f735e39b4c63c28e15c20af759295b0ac46cfd468db40465b431f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367244, "uuid": "ca5b65e1-ef0e-44f2-b593-57c9194446ec", "value": "1CF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367244, "uuid": "67632095-f800-4e9b-93b8-6d845da1179a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367244, "uuid": "942bfe9a-7398-4c4d-b0bf-f0286d992278", "value": "3072:hiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:yeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620367244, "uuid": "85e4aa16-46de-4939-885d-73ea7c83c575", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620367244, "uuid": "816caf4c-f058-4c69-b846-89d232a7da3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367244, "uuid": "8816f05e-cdf9-4953-9c7a-126dc6628902", "value": "9c726803_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6a8415-aef9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620367289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367289, "uuid": "96285912-d9ce-4d37-a216-6bfbac71aa42", "comment": "Malware payload (Dridex)", "value": "07bb68a97d8b195415caaff59775713c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367289, "uuid": "951c17d2-8424-4c56-bd5b-37724b91650a", "comment": "Malware payload (Dridex)", "value": "10ea2cb4187a12a0200df2424d4b185b6e155e4e546749efa573170888785053", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367289, "uuid": "5859f03e-0222-408d-a94c-e1f738012d43", "comment": "Malware payload (Dridex)", "value": "b6b7afaf30a559e6af0a23048686dac9d81d9950", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367289, "uuid": "1ea873cf-9559-4318-8820-590eab80a8e4", "comment": "Malware payload (Dridex)", "value": "83b6648284ccfe17014b82d1a20324918e162133cf5e0d7eac39ebb66ed39b4fcb2f39e8922c8068ffe326495ff31618", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367289, "uuid": "ab5292f6-c1dd-48db-bfad-9055ec4ab2fa", "value": "B2F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367289, "uuid": "ce683d12-d12e-402d-9883-260922dbc21c", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367289, "uuid": "8df168c9-ec4e-4a5a-8d1e-b27c204776b1", "value": "3072:hiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:yeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620367289, "uuid": "7b872835-e971-4cb7-95ab-8171eb7289ed", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620367289, "uuid": "68ab19dc-d766-4b3e-ae39-45cad241f824", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367289, "uuid": "7374b52f-0105-4a82-906b-249a72b3b681", "value": "07bb68a9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fe7fe0-af36-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620393296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393296, "uuid": "b3189089-e823-4b4d-8023-14ca53d2ff04", "comment": "Malware payload", "value": "ad6a7b327b3868e3f74909b00c2acda3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393296, "uuid": "aaa68d13-c392-4075-99d5-50c950792fb1", "comment": "Malware payload", "value": "1102af32f7339692678b214ea2397cbe4f77296c6a9e196f25596f8dd25a375e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393296, "uuid": "863a79e4-1922-4da5-af59-02f7ccc8fc45", "comment": "Malware payload", "value": "ee2cda9d058a6e43d772336616b74ce7f04ee295", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393296, "uuid": "8cecdb51-ce9e-4b7d-897d-33efd842b99b", "comment": "Malware payload", "value": "12062c54cbd5e4f57de6e9c9c33ac21058f51e76930b36d47e326520b0e2e8b49abbfdc9620fd2bfbc88382e41e010e5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393296, "uuid": "e17ecfdd-aae6-467b-85cc-f86a517656e4", "value": "1013F1301E8551B2D8340C76E7AA3041735DD776D6EF68342639C9B1E1723872BA3AE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393296, "uuid": "6d4fcb2e-f419-43eb-8cdb-33acdf491572", "value": "768:761X3nOLQ42EgHAJLd5JYOfw4foBo2PYzmS3uv3FemT52E2Jq3U7G:21us42EHYOfwloMOmZvPwE2NG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393296, "uuid": "09a5ccc6-a2e9-4fe6-add0-115e56aaf686", "value": 44208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393296, "uuid": "e70c9317-2e6f-4a01-82f0-5554fc14a241", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393296, "uuid": "ace6cf32-0dda-4e08-bd12-14e487c25100", "value": "ARMV7L(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3d377e-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407235, "uuid": "59f57599-e1d6-41b6-a392-bd9115b7a4b2", "comment": "Malware payload (Dridex)", "value": "6f1970d321c4afe295de770ef9b05400", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407235, "uuid": "50bb6bb5-42e8-49c7-a29f-7a16529b8a50", "comment": "Malware payload (Dridex)", "value": "112b25530521c6c9eda0546d812f9fd605d1957ed990de6b4c880a68f3e9914b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407235, "uuid": "9faa23bd-da3f-4b34-8506-c47c7cb2ebcd", "comment": "Malware payload (Dridex)", "value": "658ef4f79e80cf50b680bf6de935522e4f116705", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407235, "uuid": "dc41244d-d3e1-4fac-9bd7-e21ffb71455e", "comment": "Malware payload (Dridex)", "value": "55115f76aaacf99feb6a8f1149751a23a3bb2f80fc1474d7c4dab6b8dde8bc59bbe97ffc93e8bfca091d787b540fece6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407235, "uuid": "3b14ace8-0a63-4f9c-a161-c97c95d033e7", "value": "ADF3D081E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E051A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407235, "uuid": "1c88b85c-c3e9-466f-b900-aa304a95a178", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407235, "uuid": "2dcccab9-8454-4a6c-b307-e31bc05f8987", "value": "3072:qBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHRX:auXLcclWEc2HeSjNjGdexX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407235, "uuid": "3b1075a0-8506-4dec-a6be-37254b4db92e", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407235, "uuid": "1e3ec9cb-fc51-4190-9b04-e334ab935568", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407235, "uuid": "7b982ce8-ace7-4185-b579-308540257d5b", "value": "6f1970d3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0add6ee5-af1a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620381195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381195, "uuid": "da964714-e689-4ebe-96b7-319cd40115e7", "comment": "Malware payload (Formbook)", "value": "2e8b3260047d829ba61205befbaf93fd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381195, "uuid": "08698d0d-aa81-44a5-aa70-5866333f25b6", "comment": "Malware payload (Formbook)", "value": "1171bee7f280dad2201f6be582f08bf56771c54e4e0912964d93d320f4b1f32a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381195, "uuid": "37e1b9d5-f962-442d-90e0-492d2078aa57", "comment": "Malware payload (Formbook)", "value": "cc2a109e5faa29d3465c5262edbe2775e8da4bf7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381195, "uuid": "b82afe24-8501-4157-b78e-b53a980c5f0f", "comment": "Malware payload (Formbook)", "value": "4eaf74db806c1d8f50dfcd39a9fcc81cee9e77fee922b2c4264572bd5a48a592fdc4a07ab35a924b689f6b48240dbbe1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381195, "uuid": "00afb8e0-c74c-4eee-8153-a4f82f9af639", "value": "CE44124B3590C4B7D15343B04AF6A66ACBE29E14258A464327993E8D3E73EC3262D392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381195, "uuid": "301818e6-1d80-4351-b852-1a3333b413e4", "value": "6144:TEK9X0Ggr6egPpcze6ff5IpC/zCoWD8WdK:TE80V2hPM7Q45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381195, "uuid": "1ce09349-6998-44f7-a9b9-45b6c5fc79a7", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381195, "uuid": "90247791-5598-4846-b5eb-b71716389c67", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381195, "uuid": "8bf1dbb3-10fc-4edc-82f3-22d2e46b5cef", "value": "SecuriteInfo.com.Gen.Variant.Androm.29.27447.31261", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6fa86a0-af12-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620378101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378101, "uuid": "fe792a59-091c-49bf-8ae4-af1156b14d1b", "comment": "Malware payload (Dridex)", "value": "3503643273586dab44df2d43a9ba9e55", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378101, "uuid": "4b628028-93f7-41a2-a6c5-2b97b547d96c", "comment": "Malware payload (Dridex)", "value": "117542bcf4fde221e54ec02eb2200e7fee63ba8ef2574137a0e711a239c50578", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378101, "uuid": "c9102f6b-4c03-4752-a498-612db65e2bf5", "comment": "Malware payload (Dridex)", "value": "4189f105c5feb7583314834b8b75f5781c7ce638", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378101, "uuid": "b2c2fe97-c4ce-48c8-96ee-6ec664c76adf", "comment": "Malware payload (Dridex)", "value": "8fea3bd415562149e281d261e98de9814a45b8bf74bc9f2893ece4bf47aa76bef995cdbae37b502a0364490b07395989", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378101, "uuid": "3e6340c0-7a53-4a8c-9ee0-386e9f96de4c", "value": "D8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378101, "uuid": "d99e6cc7-8379-4289-81f6-c06366b2bfd3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378101, "uuid": "08e379e7-d978-40c0-a3bb-05b5269f20c3", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620378101, "uuid": "06d76e1f-2fbd-4486-9862-283abb6e263f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620378101, "uuid": "20faa387-7a33-44d5-88c8-111a79250e67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378101, "uuid": "68e34048-a365-4da4-a576-fa2a1e31dd08", "value": "35036432_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4874c0-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403559, "uuid": "79359460-11cc-41d8-9ac2-ca6a2f7fa8d7", "comment": "Malware payload (Dridex)", "value": "5b6e7b20804f644c24050d7ad5dc7094", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403559, "uuid": "78fb0819-8f87-4d89-ab92-469e946dab6c", "comment": "Malware payload (Dridex)", "value": "11c8fb719c4e595898d97995c0208e3eb0ed411933e8b099fea37f1efaaf8b79", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403559, "uuid": "230c0465-8936-4487-9eba-a47a2049f5c6", "comment": "Malware payload (Dridex)", "value": "575e424ee839591726f574ef2e4138db3898cc92", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403559, "uuid": "02f6af6e-f862-47b8-8d4d-53e8c4b98f56", "comment": "Malware payload (Dridex)", "value": "5227973d45536d1e65a4bb0ea695370dbb9cd20a0ac406379ae0b5c2f9116e0e7b65c36db7679d7fb34fc8d6601f2a97", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403559, "uuid": "3dad5d2f-9121-46ac-af8b-93e6875a4cfc", "value": "F8F3D141C9C5CCF0CBF36C3A4695963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403559, "uuid": "65cca70c-0b7d-4026-bc12-b373b53033a3", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403559, "uuid": "6d4fdf08-0aab-4996-981b-8156435982a5", "value": "3072:uuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+3l:u0czbty9uiaJlCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403559, "uuid": "c4e5f357-99ac-4477-90cd-d46ad3ff9085", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403559, "uuid": "97116cef-ce9c-4c1f-b7b4-9494607b9bf6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403559, "uuid": "edcd3a73-fd5b-49ab-a470-84e561399e5a", "value": "5b6e7b20_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c804837-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620406994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620406994, "uuid": "97dc9df6-5959-4ee9-ad2f-615592555276", "comment": "Malware payload (Dridex)", "value": "ee88d3b79b240ce0e965ad78760f39e4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620406994, "uuid": "5abf74f2-6274-44d3-b926-db5cacb1c431", "comment": "Malware payload (Dridex)", "value": "125f6c80aac2ddd6c9c9fb831d3f13ed2b4ebd987dd58f3cbd3b855faa920edc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620406994, "uuid": "7282a231-11d7-40f9-92b7-09ab45e8ae20", "comment": "Malware payload (Dridex)", "value": "881ea3bce9ea9d968e205a800291af9b0dfd3d35", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620406994, "uuid": "8caeeb3e-f55c-456f-8d0a-912227894544", "comment": "Malware payload (Dridex)", "value": "e80d00354a0df5c7251d70319d30e508a054f83113e13e1b7b83e0db6665d30364f7a1fa023c5567d4379c5ed0145bc8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620406994, "uuid": "0072fff9-3da1-4553-b56b-0f047a16c459", "value": "33F3C141C9C5CCF0CBF36C3A4695963B3228B941995A8E42EC24CE2F615F3F1F95A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620406994, "uuid": "62957f62-27ec-4c29-b901-4a9cc5fe5522", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620406994, "uuid": "f2024d71-8947-49f9-9b32-b7e6f85179b2", "value": "3072:DuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+jN:D0czbty9uiaJlqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620406994, "uuid": "9654f18d-e002-4648-a118-a66d051f72a4", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620406994, "uuid": "fef885f3-e741-435b-a7dc-371e06d8a519", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620406994, "uuid": "686afc8d-ea42-4011-869d-f6a7fc13f34e", "value": "ee88d3b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f07a0d2-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620392556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392556, "uuid": "8918480b-8efd-4560-be38-9d280dc4bcd1", "comment": "Malware payload (Dridex)", "value": "70f7f04555584d11e08448b4b8973f3e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392556, "uuid": "4dc8754c-9de7-4a74-b158-f6ca11d1de97", "comment": "Malware payload (Dridex)", "value": "1272ff1a6c331cd233fb901d4c518d5e08814379190f93332ea3ab8e91195507", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392556, "uuid": "752c10e8-3ec0-4a2d-93c7-4ae84293b612", "comment": "Malware payload (Dridex)", "value": "1385139e746427d0f94f4c049a8bd9b4c8774d61", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392556, "uuid": "5e5a6d89-c4c6-4e88-aae7-ed71f3f5bfdf", "comment": "Malware payload (Dridex)", "value": "74d3acb0d39a2f5c6d5dbd74d1ed4a98da20a01da66aec60b1c2605cbafbdb2ee69735b5d9b39d864fd0478ce7a25997", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392556, "uuid": "f03211f1-8fdd-4500-87db-891f3f581510", "value": "65F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392556, "uuid": "fbb598c2-ce64-4d73-a8d0-1532b564f2a6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392556, "uuid": "11e35b01-3ae7-41df-85a9-8f00486728d4", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392556, "uuid": "2c5c4aa7-35c0-407b-992a-b25a0bb208ea", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392556, "uuid": "5fa040a9-36a5-4e2a-85e4-8621ddaf0787", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392556, "uuid": "0cc29348-197a-4a47-aec1-e9db071f0496", "value": "70f7f045_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a967c00c-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620385326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385326, "uuid": "26eb0ac7-f1a6-44f0-88e2-46b699e69647", "comment": "Malware payload (Dridex)", "value": "a0f665659b38329c075c927f04350180", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385326, "uuid": "36ca34db-5983-4f76-8807-c2dc78d2a570", "comment": "Malware payload (Dridex)", "value": "128336922ff4f760a97e1edc120ae9bb7597e2a850f5f864153b71dc0e0ba730", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385326, "uuid": "2ac4ccf5-9693-4a12-bb51-659c5cb18167", "comment": "Malware payload (Dridex)", "value": "845a8f262682e5372c18ad1e50bd10fcd7bc9455", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385326, "uuid": "03c07200-1e16-4e65-9fb1-3b27340b9f70", "comment": "Malware payload (Dridex)", "value": "e9a3ad27625bdf5161df63a773a07abc8594e008f204d87c69796dc1b352f4afb8630e37006db4d3a876bd0cfa78fd3a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385326, "uuid": "265f1172-63d3-4362-bec9-1dc2b3982be1", "value": "4FF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385326, "uuid": "032df51d-3128-43c7-ac81-f145a302b6b9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385326, "uuid": "118279d8-4f0e-4bf1-974a-50238d61d733", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385326, "uuid": "72326fc8-2d70-4be0-977a-fb32e2195105", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385326, "uuid": "10f6a2cc-18bd-422f-b217-fd784d06f46e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385326, "uuid": "25f41023-62cb-4b9e-9c25-5381df6e8780", "value": "a0f66565_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25fca04-af12-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620378147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378147, "uuid": "e5be66a6-87fa-49b0-b5fb-c407e466a604", "comment": "Malware payload (Dridex)", "value": "3a5b7b86b5d5728d5e3b909f38e27a46", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378147, "uuid": "4ec1c2c6-dd6d-4f15-8e3e-a3b7fcb222d5", "comment": "Malware payload (Dridex)", "value": "1289f91a1319ee74701ecc9eb083838a414e53ac7d6e22852a488ed1b9d4d5e0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378147, "uuid": "7b1daec7-1996-4ae6-9f43-0b737cb44e54", "comment": "Malware payload (Dridex)", "value": "4379450a42ae43b46a87c32a4bdb5c2b36eb74bc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378147, "uuid": "793426dd-daa8-44c4-8e92-ea4e8c49e5e9", "comment": "Malware payload (Dridex)", "value": "e5644d886f8faaaa77d32691b5c0b59c9a55a3359c69ea5d125b250ef01cf92784e867b3a7e761d5f51c6c65b8253028", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378147, "uuid": "e4a71202-1428-4046-821f-473e052ad277", "value": "3BF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378147, "uuid": "37dc59b3-b47a-4323-9c27-17ec05c81c8b", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378147, "uuid": "29154349-bf21-40c7-8a98-8b995b46d5ea", "value": "3072:QiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:7eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620378147, "uuid": "f8b6333a-6373-40ac-9b97-2e41b9fd0278", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620378147, "uuid": "aaa6267b-13f1-44c5-a2b2-61e8a495bb59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378147, "uuid": "f061f775-452e-4a61-9cca-a3a77a189736", "value": "3a5b7b86_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853a0a16-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620414042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414042, "uuid": "0ae19d38-8b25-4fd3-ae10-2fe4ed5a7079", "comment": "Malware payload (Dridex)", "value": "ba0ef2d0be97dd4f4cfcca42d23e388c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414042, "uuid": "eb15b10c-6b33-46be-a068-fa72fef17dd4", "comment": "Malware payload (Dridex)", "value": "13290035c2d65ebae1b1b7d547e49fb687921527ea59675e2f1bc2b8daebb4d1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414042, "uuid": "beee3c72-a712-4be3-a31d-73b66dd6ecec", "comment": "Malware payload (Dridex)", "value": "9d038884edb16f948a3ba6599c8859f72b055311", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414042, "uuid": "37944b76-0609-4bb8-a8b8-59edd812c7c6", "comment": "Malware payload (Dridex)", "value": "14d141883c42ead65351566bbe65c7bbc2fcfb0692967e5f7693341eb9ac76f2a551b0451c2cfce4e38c7a10a63b8a2c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414042, "uuid": "f7ae3a4f-4153-4ce3-9237-38c59da61e1d", "value": "3DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414042, "uuid": "0ae76de2-6777-469d-bb3d-237ca7a6aacd", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414042, "uuid": "7f5db0e2-087f-4db5-9c5e-5fa60b9d258d", "value": "3072:Zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414042, "uuid": "449bb448-781a-47c1-98d0-648595443687", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414042, "uuid": "94fd12fa-d604-45a0-a0c7-9b5ece17c22a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414042, "uuid": "e3859d32-4052-4de0-a210-18923304882f", "value": "ba0ef2d0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba93cc04-af3a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620395233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620395233, "uuid": "b362bc6e-6454-465e-9a0e-6afeee0183c7", "comment": "Malware payload (AgentTesla)", "value": "ce47b6121ac5b0bdfee736a9981540df", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620395233, "uuid": "7fb45502-ad70-4bd6-bfac-36230815a848", "comment": "Malware payload (AgentTesla)", "value": "133cf5e1936834372a85e49df50d3246283100b13bb2f1f695ea77333756d960", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620395233, "uuid": "a1610ede-a4a7-4c6e-b647-d3245b32fee6", "comment": "Malware payload (AgentTesla)", "value": "5d68cc9f1f111225ba7d009fbb314a4a9c839ca2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620395233, "uuid": "b1323a19-5173-428f-a04b-e654dbca4ef6", "comment": "Malware payload (AgentTesla)", "value": "d114c3afa32263db68a0655443930baaa8251626173c013d65b79fc5c23836c636325aecb99051b1bebf30a91e4855f9", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620395233, "uuid": "2bfea591-437b-4119-b86e-df5f2b52adf5", "value": "4EE42374EC9F71B20B0066A197F1FFE9A3087D5530F7225636C66368889587CC8D39BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620395233, "uuid": "2f6fbae2-68f0-4d87-bddd-9ee779fe9517", "value": "12288:FjGDofFAnIyecsv3KRQBJWelzGF+K9LYA11gfRBsv8A6o7IdmpLLs0fU:ADesIHcWRBJ71Y+gcA11my8AV7Idmhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620395233, "uuid": "73e974ad-7d7c-440e-b737-e7c51cfd086c", "value": 681672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620395233, "uuid": "8688874d-982f-406a-b328-ad2746772ab9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620395233, "uuid": "7fd391a2-a77a-4827-9d43-fe84acadfdcf", "value": "numero de referencia de los documentos de envio..gz....pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842b8720-af77-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620421341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421341, "uuid": "b618f2d3-929a-4816-8f14-af67c599a923", "comment": "Malware payload", "value": "a3fd006aca78007468d0e634a6d054ff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421341, "uuid": "074a2230-2d97-4c83-8294-f6c50da22b07", "comment": "Malware payload", "value": "13876e1125a8fe0ca7d890ba90f915d37af2cb6714d0b2d2d7f93f449ca51bab", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421341, "uuid": "2ad15605-d60b-4f4b-8033-7c60e1d4a6f8", "comment": "Malware payload", "value": "d7fc05c4f6f44b7ef544afb4ee544b2f37e96b96", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421341, "uuid": "a62896c3-0aaa-470d-b5c8-4e32ae84e6fe", "comment": "Malware payload", "value": "cf6f932cb231f7bfa2d43a5590a041675e76f0e912bca988a1334c8eeaf11d6b078300eded63c9e7c4689967bca6eb90", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421341, "uuid": "509e2e85-6c52-4f4b-b8dd-4dd36abf9c90", "value": "EFF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421341, "uuid": "d8fd8f08-7dd5-4573-8a87-f0d7ef8332f9", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421341, "uuid": "5b5bd70c-7a39-413f-ac27-76a9593ef1bc", "value": "3072:9lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:9lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620421341, "uuid": "88352cfb-700b-4717-8e71-fb6c7e8390c3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620421341, "uuid": "28051cf8-ed32-4e1d-8689-e0327bf0342b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421341, "uuid": "6f2ed3b5-516b-489a-99cd-f0ccc90834c8", "value": "a3fd006a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e13757-af1e-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620383124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620383124, "uuid": "4d3be74f-e6ff-4713-b6d8-64fe15434865", "comment": "Malware payload (OskiStealer)", "value": "bdddbdfd52d8740ae768c48788804531", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620383124, "uuid": "aaf21942-0f61-41da-a852-3bc832227ce3", "comment": "Malware payload (OskiStealer)", "value": "138ccd9e494958214619110418407a634db9d8b073be4ffcd7d23083b58fb945", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620383124, "uuid": "fee074d8-dcfa-45e6-bd9f-43d8171f7b33", "comment": "Malware payload (OskiStealer)", "value": "d2d1452cd22f11e136c6d96467f893aee0477398", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620383124, "uuid": "bc682ecb-f4f5-4e7f-8665-fe592adae537", "comment": "Malware payload (OskiStealer)", "value": "88286181e960af859f15004e92ff974aca0b10e1ee1c31c7a24b1eb1654519c493ce2878e502befb0ff06ea9aedae72e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620383124, "uuid": "17922c6a-c190-4243-ae68-2b0369854194", "value": "0A0502B8AAEDDD6DC07E143C203051510D72AF875A03F7EC519CBC76ED32741AA692BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620383124, "uuid": "4420a8c7-00b1-4642-90c6-3b09e209a8e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620383124, "uuid": "a5afa7dd-b367-4cae-84a0-26834bffdc54", "value": "12288:cfPNn6chBMB0phupuG9gWXNUMbPeY7mECcsOIy3jh86UVcZgT5EvOBg1R/M:u3MmouG9TRbmHcsU186Ud6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620383124, "uuid": "c2932918-5ea8-4691-be94-3a39d1fbc920", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620383124, "uuid": "53dfb37f-7518-4517-b9f1-e0c6e399b9c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620383124, "uuid": "4c157a23-a1c3-4cca-a320-83a39eb56557", "value": "Purchase Order 07052021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c46111-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403703, "uuid": "7f1ddb64-af1d-4663-8dc9-3ab959103b61", "comment": "Malware payload (Dridex)", "value": "891b472682fd4d8aa12ce5c228328b05", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403703, "uuid": "db5aceef-e489-4a4c-b3bc-51ec8f1f9b6b", "comment": "Malware payload (Dridex)", "value": "138cd9f6dca1f792e6648fed4d303c70ac785c3d411bbbb2c201fc108c5b7217", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403703, "uuid": "6fc26ecd-d51b-45ba-b841-6e4b31783c4d", "comment": "Malware payload (Dridex)", "value": "67bfb1d9ede98a8ca2335c0528864071d0bb4b41", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403703, "uuid": "b869b2a6-273a-4299-bd56-3c1979cdb2db", "comment": "Malware payload (Dridex)", "value": "965674dfaec5b0b48fe12221490fee15217ec29fa4063459f6888aa40d38aacae4f314b53702c2fbdd1480156aa8d3eb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403703, "uuid": "5a000e35-112e-4106-a273-290597654fc3", "value": "E5F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABD95BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403703, "uuid": "a445f4c5-5eea-4e4d-9540-580db76b1ebd", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403703, "uuid": "45ad68cc-6ea8-4f3a-9009-b0497738f532", "value": "3072:XBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHtZ:RuXLcclWEc2HeSjNjGdeNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403703, "uuid": "12e909ef-1e84-442f-8453-ac66b2aca365", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403703, "uuid": "2a0edd23-dc4e-4ed1-9b38-9a12e7ac0435", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403703, "uuid": "54fb85fc-1334-4b41-92c2-146a65745ec7", "value": "891b4726_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927c550c-af2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620389583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389583, "uuid": "dbe528b1-0186-4d13-b2bd-c07d039c2a63", "comment": "Malware payload (TrickBot)", "value": "3cba56c6a4b1b3798b4ebfbaf40fbd6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389583, "uuid": "07d489d4-2e94-4bde-bc12-29998c742278", "comment": "Malware payload (TrickBot)", "value": "13bebdb4628ed345121aaaae5c512e528d01f3cca6da932c165a7d261c0f0356", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389583, "uuid": "c2e1512a-c40a-4a68-97f7-2bd89f197c31", "comment": "Malware payload (TrickBot)", "value": "7d9ef98a82459a8895475ec33da438c2ac2aec69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389583, "uuid": "73b90fda-e3ac-4894-ba92-35268e09cc7d", "comment": "Malware payload (TrickBot)", "value": "0d6a60f32afe1c8579fa93c323b071dfcada00e8b74800e6755c4114c920e3fcd8d6ee1f27289327ebd1b2fe815067f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389583, "uuid": "bcc89c50-c8c1-4c96-be2d-c42724e51dd7", "value": "80F4BE02B2D1C177FAE202714FEAEEF7EAF5F9114A295447F3D62B0D19719434A36A20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389583, "uuid": "8c0893ba-98b7-4785-9433-6e7991aec875", "value": "a854f0696e579de7373340a712e95c97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389583, "uuid": "05b9c3d0-fcb5-4f48-a617-ba359f46eafc", "value": "12288:bZfAStuSnRmDuGQ9bNfvzj04ueQlzxE30wIpgfCORMxVB:h5RmKNfbw4ueQhuEZifCqMxVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620389583, "uuid": "c1da39e4-4f75-49bf-9a57-5c6aa6f63361", "value": 757828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620389583, "uuid": "cf075900-2d17-4707-a6c8-0cea8b36c523", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389583, "uuid": "523993b4-df94-4246-a651-c33c7874fde9", "value": "3cba56c6a4b1b3798b4ebfbaf40fbd6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172a3789-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620406985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620406985, "uuid": "ab79e7c3-fde2-4b1b-8614-507cdc73029c", "comment": "Malware payload (Dridex)", "value": "d6b1eecab5e1a66cd7ddbf29b161bde8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620406985, "uuid": "ebbdb3d5-51c6-4333-8981-7f1e350d987b", "comment": "Malware payload (Dridex)", "value": "13bfc7b1953913f395b00e8687057faaa80a0828174ae0b74a5e68de549e1538", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620406985, "uuid": "11f6ee8e-a6fe-43f9-a645-eba544a9cba7", "comment": "Malware payload (Dridex)", "value": "dfee127556466de1bddfd89c03ebe563fba989fc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620406985, "uuid": "2803d651-d4cb-45c1-87fd-e5c3d1eb3928", "comment": "Malware payload (Dridex)", "value": "60350032754a8853e4aac3814cf43ad9f327556cd2b9ba125d0f9f965fdc8d6b191f98937e94132aa7617661864a1c52", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620406985, "uuid": "863d45c8-f1f0-4f7d-9e7e-378768554a01", "value": "48F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620406985, "uuid": "fabcbbe2-1a7b-44ad-8111-85589f63a701", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620406985, "uuid": "b837facb-d8fc-42e6-95dc-0f657d2c3d96", "value": "3072:nA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:n3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620406985, "uuid": "ef3220a0-bdfb-4781-b3a3-5f69eff00d10", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620406985, "uuid": "cdb9ab9f-6b83-406b-bc3a-808aab83a337", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620406985, "uuid": "70e71b80-a7a7-4cb7-837a-6b9221d6b75a", "value": "d6b1eeca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66101ff4-af77-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620421291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421291, "uuid": "52bd5417-5a49-4ee5-a052-61d96db59bde", "comment": "Malware payload (Dridex)", "value": "8f0947bc07f8a7ebf78b93dfa518dc85", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421291, "uuid": "15fd6c62-03a1-46a4-becb-74d4bbd3b70e", "comment": "Malware payload (Dridex)", "value": "13c1c2d6c4c5ae1d334f78271ebeb85983a68ce061296d936c480c82065c6e06", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421291, "uuid": "6feb5920-29e3-4826-bbde-e732d05070a0", "comment": "Malware payload (Dridex)", "value": "d50580bb02e908a6b4475c87be22d61a5008e25e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421291, "uuid": "ad9870e6-866d-44ff-95eb-e65608a51910", "comment": "Malware payload (Dridex)", "value": "394156837b56e8df9adeeb14f4950cf1b8f8c3a4021d7a5662a945ad078743512002cf26c0cc75d4aebf8b88e0eec5c2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421291, "uuid": "bf566ef7-f951-4a98-b4a1-f1d83371ab89", "value": "EFF3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421291, "uuid": "7c74db76-261a-407b-9a74-bef1fac5f9ab", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421291, "uuid": "a6f335a1-9793-45e3-8811-103c7b1639b3", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620421291, "uuid": "fea51d0f-3153-4bf9-800a-8c8153a0a47c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620421291, "uuid": "a457f4f3-cd2b-468e-897d-a5334c6ce178", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421291, "uuid": "f3d74424-73a3-43bd-8645-983cecb7b393", "value": "8f0947bc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd68315-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620385310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385310, "uuid": "be9e0883-9661-4ae8-83a3-050ccfe07a7a", "comment": "Malware payload (Dridex)", "value": "54d59651e784b18095c9b1600392a7d5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385310, "uuid": "17d88991-a3bf-42fb-a5fd-833c3cf521b5", "comment": "Malware payload (Dridex)", "value": "13c64404208b91d4b96dfec5362e9b54c8e1c696d18cdbfb7db068cfcfbcb6e8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385310, "uuid": "4da68ed7-831e-4a0e-a42f-f79191f2cd43", "comment": "Malware payload (Dridex)", "value": "57f15c7430787d7e74b2e9ff96a6c0926aeef3fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385310, "uuid": "1b9a27c0-d5c8-4111-80a1-3ec9f43014bf", "comment": "Malware payload (Dridex)", "value": "6d057f029019aa698979655d017ee178de6f928d24ae06a15104cfdec8eb79ede82f82883f74f09105760d8be6ae9ce2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385310, "uuid": "70fad67a-18a8-404d-adfd-00f9f74c7a6a", "value": "46F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385310, "uuid": "91cc63b5-ea54-48eb-9836-d2874da2ebc7", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385310, "uuid": "453bb3a6-c0e9-436c-b62f-d292e1783d9c", "value": "3072:DA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:D3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385310, "uuid": "2cfc0809-5487-44d8-bad0-3cfca5ea3ffd", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385310, "uuid": "5fb8fbda-9d61-488a-9b27-18d7719852e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385310, "uuid": "1018b2ae-8a88-4884-b822-aeb81071c36c", "value": "54d59651_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02daf00-aee0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620356534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356534, "uuid": "edf558e0-7c06-4b24-9219-2a9206816820", "comment": "Malware payload (Dridex)", "value": "01fa39d6f2197cd930f1546c9c25a65f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356534, "uuid": "da39946e-99ed-4b3e-b8eb-6e8ec6250e84", "comment": "Malware payload (Dridex)", "value": "13e3dca6d73deab2e563cbb614e409ac90b4a04a8f11ee2b1ffc4cbc6f8d7825", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356534, "uuid": "120a4e70-1b43-428d-86f7-6775652a5364", "comment": "Malware payload (Dridex)", "value": "481017f422121455ebadbc31dc177259ceac6907", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356534, "uuid": "49dd6508-5c96-4772-9ea2-eb34b0f5e2ba", "comment": "Malware payload (Dridex)", "value": "f1bf6ec647177a87c0ba8f03f915520ce5af1d29edf76fa53433034bf522afd758a238d057fb9f300ffcf7d11f7b3ca9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356534, "uuid": "c4daefb3-0cfa-4831-9307-ac73f111dd39", "value": "EAF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356534, "uuid": "6492f7ea-c677-4823-91ad-89b1d040dd30", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356534, "uuid": "1eb7f2c3-1a17-4734-bd50-7334f466d743", "value": "3072:blpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:blo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620356534, "uuid": "7f6304d4-3bfe-4781-9bd5-8db6d5a8242c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620356534, "uuid": "eb480cb4-119f-4ae6-8453-547c3c64796c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356534, "uuid": "68ca39c6-b2ca-4917-b611-3c767700ee90", "value": "01fa39d6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ff6576-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403567, "uuid": "98fb6c15-1f51-4a9c-83ce-009862af32b4", "comment": "Malware payload (Dridex)", "value": "31fc71125e4b2dbe0ba897ebe9ab7dbb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403567, "uuid": "4dbd5b8e-458b-4969-888e-64f0904289c6", "comment": "Malware payload (Dridex)", "value": "13ee0c27dcde3a6e964578f78b240d1dc8b2bee56c8651ed206ca7b3174efaaa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403567, "uuid": "ad9aa0d9-b485-43ec-93b8-17f7e91bde99", "comment": "Malware payload (Dridex)", "value": "b4c3f6455af6607b92187e23dfc88dc75b065feb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403567, "uuid": "5234b311-2ee7-4e25-82d9-03e06475ed54", "comment": "Malware payload (Dridex)", "value": "d011dee80afddb24c0bcfd35e39d03ff687f2ace85fce979fb7a0e547cf3db9612c6375c695284cb693f0ae8d27639f7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403567, "uuid": "aa925b60-feb4-4d69-b59c-38f855a88c19", "value": "9DF3D081E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E051A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403567, "uuid": "f692b9a2-165f-436d-b594-fc468582a01e", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403567, "uuid": "c616fcb0-7f75-45c6-892d-f6dc1b012a37", "value": "3072:gBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHRX:UuXLcclWEc2HeSjNjGdexX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403567, "uuid": "d7fb37cc-11e0-4e4e-b58f-aeb459a3f47b", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403567, "uuid": "63063af3-543d-43e9-a2d0-c47f62ba6a7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403567, "uuid": "f40dc6ec-b71c-4536-80b2-640effe1dbf1", "value": "31fc7112_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78194061-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620392545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392545, "uuid": "0d647a01-dfbf-49bc-9b9f-2b484d2779e9", "comment": "Malware payload (Quakbot)", "value": "04a42746c15c78603ef6934e22c12f19", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392545, "uuid": "d8dbc4f8-a625-44da-8184-a441c262b610", "comment": "Malware payload (Quakbot)", "value": "1419ea24a80726cf8a5ff762f57be4cad2c8adc1711ea4868370b65fd191c80c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392545, "uuid": "927d3e06-ea26-4810-8e5c-e5e6140683bd", "comment": "Malware payload (Quakbot)", "value": "590af126e5282481bf1d74bd182c3b9ef85323d3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392545, "uuid": "3a81af9f-b6e3-4f5a-8862-90cce7ea91cd", "comment": "Malware payload (Quakbot)", "value": "25a17c9f4dd0e372d9320a0580ccbd9298e5e307bcbfbab996ff5e21dba1a47f9cbd49a4915347f10b684ffe87d1fe58", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392545, "uuid": "fe59f7df-0293-41c1-8b13-289a7dbb229c", "value": "DD57D7637DC85E05CBDB9872C7BD439C8A970D090661540DBE2FF648F96E4B2205AEBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392545, "uuid": "9a67e969-7607-4ecf-a9f1-f08c44b4b48e", "value": "49152:HDQbFckvcwyLES0mHabS3zD+1FxLJFSRFsLJaV3RNJdxpDQ92:HkbFcMwIaCV9G5npkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392545, "uuid": "3f00d50c-029c-4ec4-9afa-b1317bbd7b10", "value": 28724574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392545, "uuid": "dec5fb99-a33a-4d5c-bfa5-929b1015d104", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392545, "uuid": "3fa8906c-101c-4686-a159-dd942c58d718", "value": "04a42746_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cdb4cb3-aec7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620345630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345630, "uuid": "3d361836-ce55-443a-ad52-6fe89a5f0468", "comment": "Malware payload (Dridex)", "value": "cc264c6284a93c0d098324b4b37338f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345630, "uuid": "9b2de67c-cbfb-45a4-aa43-471a562a93d5", "comment": "Malware payload (Dridex)", "value": "149430549e4ead0ddedea839a7e77a90c3529092400c8c27248367c2d39c8e6e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345630, "uuid": "6c7f7165-1d8d-4ab5-92bf-8f1bca6f8091", "comment": "Malware payload (Dridex)", "value": "8711c4d1e3ba9683882e6a73429bc72fcb00ea62", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345630, "uuid": "dcf1916a-32c3-4edd-91bf-260d8cce8d38", "comment": "Malware payload (Dridex)", "value": "be9c2aca336df332aeb00bd541408ddb9201f8df545cde5c7c6399d174571ff77ff04c2a78daad6e5c7201dd85f8a01a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345630, "uuid": "ab8b93e6-6ecd-4da5-b6f0-3a47e2f1c772", "value": "89F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345630, "uuid": "becfc73b-2d68-4f77-9783-319c62a22369", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345630, "uuid": "2637f8e4-c696-4ac2-898c-d4f31a389cfe", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620345630, "uuid": "bb9c6a05-94e0-452a-bdf5-cdfe7fa90def", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620345630, "uuid": "486d9e59-d7ec-4db3-ae0d-522b829e9798", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345630, "uuid": "8c2452d4-28fd-4683-a4a7-76de5149cf54", "value": "cc264c62_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c0ce4d-af1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620381676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381676, "uuid": "91531c17-3a94-49c2-99f9-35474603778e", "comment": "Malware payload (Dridex)", "value": "95b3f62be738a2c69d18369a6514f6da", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381676, "uuid": "d2d3e978-a9a1-45a8-89eb-70e34df9b151", "comment": "Malware payload (Dridex)", "value": "14a27a1636d1e37d2ae63cd4cba4fee2355a5ad2f6bbdf512811a7b054298931", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381676, "uuid": "d72fa74e-1607-4b74-aaa7-d752b8d4bae7", "comment": "Malware payload (Dridex)", "value": "c31cf239cce3dd6f8e36fbe418df4f9b50a94a1b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381676, "uuid": "e6250312-8139-4c0a-9bf8-bb44134a5bfd", "comment": "Malware payload (Dridex)", "value": "ee1b606544d71d537e77d8536cbce019ddd060d85081ef2b3d4c90fae9ed3e812e2b3bef81361304e1a5356af5910d26", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381676, "uuid": "ec41d308-3a2b-4242-b272-36d66d1234c0", "value": "81F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381676, "uuid": "e97cb445-b4d0-40b1-a5a2-d82ce63172bd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381676, "uuid": "a3672d34-c73e-4560-ab1e-b8ddbb83f473", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381676, "uuid": "7b326189-dfda-4e59-935a-a7b66eb61973", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381676, "uuid": "a3cc97f6-8123-4f45-a9e9-259b3bc98dc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381676, "uuid": "7a03e115-ec91-4242-9699-36cca223a551", "value": "95b3f62b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ffd665-af1a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620381186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381186, "uuid": "f7d33c8a-1bac-46c0-ad8d-97735dc424ec", "comment": "Malware payload (AgentTesla)", "value": "36ba87094b65f7777f9f617e95470d5a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381186, "uuid": "7f84061e-ab7d-4e0f-a114-6509705c0818", "comment": "Malware payload (AgentTesla)", "value": "15416beee0459246133e239c2981f5a60b5559ee0dd40113cbcab3d3906ac846", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381186, "uuid": "216e89f2-9397-4ef8-8af4-5308bb442197", "comment": "Malware payload (AgentTesla)", "value": "9543e90f49153628229d4fd3d5dfe50253590811", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381186, "uuid": "758944fc-147f-4d16-b26c-f33e0298c96f", "comment": "Malware payload (AgentTesla)", "value": "ea69eedd562ce885b281a0b2ec47bbffb2d3f7711bd250b8a3680de4cb2cc236eda13c6d225185769d22e8d0d3e6f79c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381186, "uuid": "c11817fb-7533-45dc-a0fe-6c85646c9c16", "value": "21539EA1DA000C01EDA7CF7138D9C75527717F8A55E182AF60A9B953FBF63422D680EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381186, "uuid": "f8781d4d-1c83-4364-b2d8-f86f6d7405db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381186, "uuid": "e29c56a1-0a45-4910-8b77-12a7f2a16953", "value": "768:CZwqNrzS1giN0W+aIsXUnc5Jns6XBurv4ZYq1t+CT8luYOoWhRzet/rDGdhKqDGx:69k1giN2kKYxurvq1t+CIluY6Ej33h7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381186, "uuid": "befb3a5c-2751-4489-9c04-77e602eb5a13", "value": 66280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381186, "uuid": "8772bce8-01ea-430e-b063-d1c2a977f6a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381186, "uuid": "7a5ae353-297c-45a4-81b0-23a5d2299bdd", "value": "SecuriteInfo.com.Trojan.Discord.8711.8489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6660e2f5-af0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620374476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374476, "uuid": "836df63c-4337-4444-a5ea-4c374196ea64", "comment": "Malware payload (Dridex)", "value": "b7dba81b74b47f229832ef6ab2354f16", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374476, "uuid": "5686beaf-41c5-4f08-8784-ca0fce069da9", "comment": "Malware payload (Dridex)", "value": "154e400a50d0681f64aceb8946b1ddc969fd0928b46023e0badf74dc949469c8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374476, "uuid": "b81520e7-e336-45c7-913c-416bd5e9ee86", "comment": "Malware payload (Dridex)", "value": "e7bd5d80e8d3c321ef0c111e7dd1153eb7178ad7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374476, "uuid": "44f9cc6a-04a2-4bcf-89ea-5cea01ebf7a4", "comment": "Malware payload (Dridex)", "value": "29ad9228557e1f4ccc08d12b02d7ae77f5e7819d53e071fe027d0176e30141a5c7f33780ade123b9a0da4735237a6e74", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374476, "uuid": "4598792c-3426-4796-b9cf-7f857fd859b3", "value": "DFF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374476, "uuid": "3516362a-2abb-4b04-9225-7047ca5ddb8b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374476, "uuid": "8ece8ca0-1552-4852-a097-82febd29ff65", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374476, "uuid": "028484b6-e3ab-48fd-977a-41f5aa05e263", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374476, "uuid": "d14b5c42-dab4-4ca0-95ed-ae0f75266832", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374476, "uuid": "45d61d32-4871-4e76-b917-dfed4efb9fbb", "value": "b7dba81b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deeda010-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403884, "uuid": "e95da828-d25d-4f4d-9446-4097cf6b9a42", "comment": "Malware payload (Dridex)", "value": "701acf6e2672a9d2ecfd5e8de9099ad6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403884, "uuid": "6961f625-4bee-49d1-956e-6c43355c653b", "comment": "Malware payload (Dridex)", "value": "1588cf92ce0cd2a5bbc771deb3f79c8ea74685d62217dd5a6a77fba43ebfe319", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403884, "uuid": "50cf7d3f-05dc-4c18-8bcc-7df3760e5001", "comment": "Malware payload (Dridex)", "value": "47471886d0d5a05dbb523f86ea1ced2a0e95ed67", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403884, "uuid": "b41c818b-69c3-4eb0-b3f6-58a2ca7652f8", "comment": "Malware payload (Dridex)", "value": "19c9edc0fca6ec42388c0d52b90f83e456418ba4dce7aee84a5a618134fe8d6bf58afc8ad868114e544823a615e96cec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403884, "uuid": "95f2a908-b946-400b-85eb-4ff487063bdd", "value": "8FF3C141C9C5CCF0CBE36C3A4695963B3728B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403884, "uuid": "555c6d6b-d25c-4650-8c25-9834654434dd", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403884, "uuid": "52f53b37-63ea-43d0-b6bf-a7fc02e61151", "value": "3072:PuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+0Hl:P0czbty9uiaJlhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403884, "uuid": "1a2c2828-8c0e-4854-baea-1d78be312b73", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403884, "uuid": "ab828286-e4cb-47b4-b2ee-b06d15c9364d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403884, "uuid": "d1aad3c0-f92b-4064-afcc-36f02fd991a5", "value": "701acf6e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bfda6a-aef3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Pony)", "timestamp": 1620364456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364456, "uuid": "0007d498-b141-47c7-a4ed-aef7e15f1ed3", "comment": "Malware payload (Pony)", "value": "f50c60a10a65fe50c644ee5d20091e14", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364456, "uuid": "fcd3bd1a-264d-40fb-919b-a24c10278a11", "comment": "Malware payload (Pony)", "value": "15aa1919120cf819c2c0386a0a6b8b71059fa669491016b06df0998a27eb32ff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364456, "uuid": "084f1a54-e4e5-40a1-bc02-438ed9432290", "comment": "Malware payload (Pony)", "value": "f6ec05879fb51f9f1fdd9771d206bdd5ec4a17ce", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364456, "uuid": "cfcfe54b-958a-4eed-a62d-253519af151c", "comment": "Malware payload (Pony)", "value": "26a4281bf4d8531f7081a9600fdfbf9327b90e1cbfb4aee315a6749b08f49171a781f32fb67335a046fb291235459c60", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364456, "uuid": "cb4ab751-1ba3-4e22-9840-2d05aea661f2", "value": "1624CF121518CDB5F13D6A31DE24BFF9EB24BC219977A7C61D6917182FA1AACC70CE80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364456, "uuid": "04abd57b-6b14-487c-b8f5-dbe0cc7c5e70", "value": "faef5c0f1f3bbb03196a71e2093fd2a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364456, "uuid": "81137f32-538f-4de2-836b-1a86f5dd0fbf", "value": "1536:sCy4svmF6Z+tHWFbOuTI+6DvLZjyrSGC+3LzejnlcAKmNJvgIXMkJ2rtx7yARkzl:Nmj+sTI+6zOSd+Xerlcm3X9Wtx7jk1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364456, "uuid": "cb070fb5-4ddc-450c-b37b-ba8d5928db81", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364456, "uuid": "d543f6a5-968c-4c03-b139-b475f43904b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364456, "uuid": "20ec880a-f1c9-4e66-b5d9-8d0930415304", "value": "crimgroup(2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef00b3b1-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403482, "uuid": "ffb4429a-bcf5-46d4-a0dd-a1541451cdc6", "comment": "Malware payload (Dridex)", "value": "28d96931da6539546e6c9b8933c79b70", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403482, "uuid": "c6c869f3-59f7-4c51-9bf2-8e083d6f495e", "comment": "Malware payload (Dridex)", "value": "15e87a1f8a642df308f0645129c8bbaab909ae5308860291aa92b1e5a5363bfa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403482, "uuid": "dabb28ec-b5e2-4700-bf18-41a1a80d7a11", "comment": "Malware payload (Dridex)", "value": "34fa08ef4bba8533a9d7783ddb77503fdd9cfea6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403482, "uuid": "fd382eb4-becd-47e6-b290-6c66c86cb4af", "comment": "Malware payload (Dridex)", "value": "e4362e6416a5ffe46feb9f906050c6f454db5a2cdbf99c42f3a439e10119edb3648ff813072bab49f9472a541b4e9229", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403482, "uuid": "244cff20-efbe-4d05-b7f9-e7be76f98f23", "value": "D4F3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403482, "uuid": "1a3cf88f-dbf1-4d8f-8e0f-30b0806418bf", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403482, "uuid": "2ec9f9fa-d593-4794-be1f-d2073a301702", "value": "3072:7BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHSa:9uXLcclWEc2HeSjNjGdeya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403482, "uuid": "04b0e963-3b5f-4e22-af9f-774751a413d2", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403482, "uuid": "5e672eeb-20b0-4c57-a70d-e458865f6ad2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403482, "uuid": "e2d2ea8a-1cfe-4469-8cc5-80df2c4731cc", "value": "28d96931_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dcedf7d-af1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620381710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381710, "uuid": "095a8d7e-326f-41b3-b201-3162561cf30d", "comment": "Malware payload (Dridex)", "value": "e3d9e45572a08f0a0435413bcb21c412", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381710, "uuid": "ed7dd264-1709-4f3e-8379-deaf01c10061", "comment": "Malware payload (Dridex)", "value": "162cbc778e511c82ad2462f2661e8ea4a20e4d7cd44a2e017f01ec837ff4193f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381710, "uuid": "acacfbe8-0b98-47fa-a40f-d4dd5ae1ec5b", "comment": "Malware payload (Dridex)", "value": "04a3bce2ba25f96e1ea966fabef5e635eaacd2d7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381710, "uuid": "472bf623-4f8a-4b21-a6bb-8db5e5106e1c", "comment": "Malware payload (Dridex)", "value": "9be14162d547dcd1f9b61c88304dcebf4daa3ed390e1c595d8d92752515a353aff6b77995bde5e688934149ed2e36a6f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381710, "uuid": "f7bbe50b-6e89-40e9-b7ac-7e7516abcf87", "value": "4BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381710, "uuid": "17bb89be-e64d-45db-8c07-f23f965f0d81", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381710, "uuid": "46d6217d-0d37-4171-bdfa-fc9feb18ac48", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381710, "uuid": "799e1322-cd3f-4307-8ee7-3566cd14b96f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381710, "uuid": "c37386c4-dbfa-49bd-962c-212f540170dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381710, "uuid": "deed481a-25a9-4ba4-bb92-d77b98e0de15", "value": "e3d9e455_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc41dad-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407241, "uuid": "e633c659-135f-480e-b6f2-e128bf124fdc", "comment": "Malware payload (Dridex)", "value": "c02a1f06a64ea7d02a221ce12357e7db", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407241, "uuid": "09c29de1-68c5-451b-b01a-83a74e429329", "comment": "Malware payload (Dridex)", "value": "1670b6434e2bee08defb2613142b348a1b61071338abbb9fc644d1e54a767b37", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407241, "uuid": "8491ec8f-8e0a-40e3-a00e-56ecafb122fb", "comment": "Malware payload (Dridex)", "value": "7e26e4ad778ecd96b478f3c082fa2853f4d91a23", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407241, "uuid": "5c0b3c59-844a-4489-ba9e-9ff99478741c", "comment": "Malware payload (Dridex)", "value": "b8061ac69376177218b123dfae92597855efc645ad63845162ec8e4b7bdf021f9b3dabdedd2541a5a02ce8d3a9c4deb1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407241, "uuid": "d45b27dd-4406-482f-beba-9ebbe0dc669f", "value": "B2F3D081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407241, "uuid": "9977502b-341b-442c-9a6c-d02946994d47", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407241, "uuid": "2dc707f3-5464-4160-8b19-4b76bb634381", "value": "3072:3BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHC/:xuXLcclWEc2HeSjNjGdei/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407241, "uuid": "6781fec3-3cb6-4dbb-8fe4-8b0d616871a3", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407241, "uuid": "da64708c-403e-4aa2-b1ac-7f92b3f28fd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407241, "uuid": "a93ef410-e16d-4a82-8b4d-9298be7eadca", "value": "c02a1f06_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094b8b7d-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407391, "uuid": "1aed3241-0d68-44cc-99c6-90c4ce8fb4c0", "comment": "Malware payload (Dridex)", "value": "0daf0e23ce618b0a71081dd5c1db3291", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407391, "uuid": "86272abb-ffd0-4f22-9618-695c44ab61e9", "comment": "Malware payload (Dridex)", "value": "1673d6ec8991c022ddadea90ade7741e4256f1cd07d2f1562e837d9db9f886bd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407391, "uuid": "7062745e-d9b4-40da-af0b-6900dfdbc3c4", "comment": "Malware payload (Dridex)", "value": "9e51243c0eca7a6214953a8302a14fa431729e6a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407391, "uuid": "2e4c48cd-8048-4f64-b219-ff7de32670a0", "comment": "Malware payload (Dridex)", "value": "d2a68d8e6a0d00824cd2ded6737be643c2e49bdbc1bfb1feb890362f8fc83da051f4f1810d614b1a0420cb64e1ca15e5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407391, "uuid": "35dbce69-596c-4439-ba83-0716bb418359", "value": "9CF3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407391, "uuid": "4f30d670-e088-49e2-a8f6-a81ba15ab77a", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407391, "uuid": "e25f4a53-9724-45ad-af1d-ac1f781de362", "value": "3072:1BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjf:7uXLcclWEc2HeSjNjGdeDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407391, "uuid": "b8522220-19a9-446a-960c-38fbb9c06f01", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407391, "uuid": "ac83f5b9-2963-4923-bfb8-cacbee93e638", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407391, "uuid": "aecc262e-6d71-422d-8a18-db55455d7abb", "value": "0daf0e23_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139a4c23-af3e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620396671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396671, "uuid": "222421ce-d9db-45a6-ab9a-198a20333959", "comment": "Malware payload", "value": "2b651045ac2854395a477518609b5651", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396671, "uuid": "e96821b8-41b0-426b-be87-5a27ba053c08", "comment": "Malware payload", "value": "16c58cefb849e5e54c9c82839850e26d948ddc92c6485f747c354123feefc84c", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396671, "uuid": "777ae917-ef47-4742-8088-a5538d09b28e", "comment": "Malware payload", "value": "30b4e324aebde5f595a8f71e0f483a1946d23de9", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396671, "uuid": "3f2b249a-a0c5-4391-bcc4-627813fcf9a5", "comment": "Malware payload", "value": "26e39ae586e6a955075d25bf3fd38241ae5ed00e44c16c98b3c0117fdf9fd6dc4919a838c4b9adf3cd9bf89da35bbd99", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396671, "uuid": "a3b303a0-d5c1-41ea-bd88-fad877f889c1", "value": "D344230AE1D22C99E47F2BF5116116586B9EF2E5D0EC85FE53CC189D0471B7F33822A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396671, "uuid": "081bc408-f652-4c55-90f1-4ce85a011019", "value": "6144:IL8BhwX2k9zTXFZMJoFyUSYOoHGjXsuHlRa0mTbQYBN27e8tmxnpa:IV19zIoFyUS1omjXhObEq88M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620396671, "uuid": "eb87e5fb-5589-4a70-b946-932adbad816d", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620396671, "uuid": "c17c60ed-8f20-4392-8b80-aed006e4be73", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396671, "uuid": "20cab60c-bf2d-47af-b179-2af04a6df610", "value": "16c58cefb849e5e54c9c82839850e26d948ddc92c6485f747c354123feefc84c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b501afa0-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404243, "uuid": "944b8c86-efa3-40e5-92d5-77d57ee57854", "comment": "Malware payload (Dridex)", "value": "d0e18890ae83c67bf5463e18ba8dba98", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404243, "uuid": "1cc00036-eb8d-4a5d-aaaa-19c363de9d45", "comment": "Malware payload (Dridex)", "value": "16e006e3c52ceccdc67e5731d21259fe6cc20d2b6ff0cdb9c122c5cb17d3ec86", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404243, "uuid": "226c5209-4b9c-4e23-95e5-b981d7122395", "comment": "Malware payload (Dridex)", "value": "e9a4b2604397f7995d7e3278e7ae411380cf062b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404243, "uuid": "090dcafa-45f4-4cbe-8c39-c0fe51f1702b", "comment": "Malware payload (Dridex)", "value": "9ec01c3cc3549541338e8ae74e2022a893ee830dc84edc2741f14029068c0f88dcac9a3413735ef1e5d6d7433fcc0dad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404243, "uuid": "1381ca80-26a5-4f10-94fd-0abfdfa3aea8", "value": "86F3D088CBB3E4E6EFB3937866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404243, "uuid": "f2e34d34-4d63-4acc-a6b5-d1888aa7c127", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404243, "uuid": "2d714278-3cbc-4b25-ba3d-921323a61624", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404243, "uuid": "e290a301-5b00-40b9-a46d-c816afb423ad", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404243, "uuid": "18230bea-0add-4ef6-a4ce-9885c3a2bf5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404243, "uuid": "5bf2c95c-08f3-48dc-8898-f6e9c51697c6", "value": "d0e18890_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b6d379-af37-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620393906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393906, "uuid": "7560740d-53a7-440a-aa2c-15eea8529a49", "comment": "Malware payload", "value": "1fde5b0d8e3aefba8cf327ad3a83c932", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393906, "uuid": "58668597-edc0-448d-9add-d3d62dcda968", "comment": "Malware payload", "value": "1735787ab6f029e60943ad5a7364e451e672ca4a0d6a55b8c1fec15f37f8ad36", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393906, "uuid": "2deb0113-53e7-4a61-b9f8-c12fac9dd451", "comment": "Malware payload", "value": "69666d1aeb6ebdc0a31ccb315b0d4c5058f7a7ad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393906, "uuid": "823fa988-dfd1-4a35-9815-60919d3b1542", "comment": "Malware payload", "value": "ef7c74b3f2b29187977bf4c5c8f58bffa394d3e1824526cd8fadb3bbae5844cb134e3e2445c4b317c7bd3f52fa391d8d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393906, "uuid": "67027c4e-b401-4be6-bcb0-20678d925daa", "value": "B6C2D050D0DA0E92D7FB6BB148609DD77BF057A434628DB302E0DB018295E5AB772EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393906, "uuid": "3e0c35fd-f6a4-4735-9908-6cab95255975", "value": "768:UjUznjT1CHOyRT56KfSFVkFxtT4uVcqgw0RNWXI:Ujo31OJSKAVktT4u+qgw0bWXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393906, "uuid": "779bfada-47e5-4b7e-9925-20681c9e09db", "value": 27516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393906, "uuid": "155ebb3d-2651-4aeb-aa1f-dca41a74ab79", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393906, "uuid": "8c85e031-f503-4471-8d5c-6e255f4aa328", "value": "blxntz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296633a4-af47-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620400573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400573, "uuid": "b4f66c20-2d6d-4384-9e06-1a6c6caf4a02", "comment": "Malware payload (Dridex)", "value": "174daa4f9796883ea6fc58c985ef8d25", "object_relation": "md5", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400573, "uuid": "733efb27-1027-4ad7-8c06-555d467e02e2", "comment": "Malware payload (Dridex)", "value": "1740346d3f6bcb88429e0653a959c6b105371ac1f5465d5199ac89861802a44f", "object_relation": "sha256", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400573, "uuid": "0da6c0e6-2f13-4237-95da-c3c54484a9c8", "comment": "Malware payload (Dridex)", "value": "b634e158a39735eb5fd53e45f3fbc1ed76d64c2a", "object_relation": "sha1", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400573, "uuid": "809fb56c-8c64-4594-aa67-7c832bd056bc", "comment": "Malware payload (Dridex)", "value": "cd98debb8aa1b4398e79fc2b1af6a696d217bfa4ca4825e2a9946f24838de6dbc3b36a32124ddb0bdf59474359c2c60d", "object_relation": "sha3-384", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400573, "uuid": "aad987a2-d090-4334-acfa-de3583fd10a1", "value": "2E241289C8E6EA2BCFA7243A42955FA32197B05192F37C1CB60DF63DB74CD0264A14D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400573, "uuid": "f0cb496a-389c-4c67-9f68-e15db8e9421f", "value": "6144:gTHRdfIO+/ENhLv5xyGBVeJZnC469axilrxDv:g7fn+crRBjeJZ369KYrxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620400573, "uuid": "3262ca1b-5aaa-4180-87fd-a60ca0af7b22", "value": 224437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620400573, "uuid": "c374d6e1-cb8d-4961-8755-1762508ffb54", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400573, "uuid": "6b733cf1-2c90-4750-82df-e63b8b51c578", "value": "generated purchase order 729652.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d93e7d3-af5e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620410539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410539, "uuid": "2b9bcdcd-bafa-4a70-8523-10933419880d", "comment": "Malware payload (Dridex)", "value": "2b9f954c1dd2b7b5ae651ae618546c2c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410539, "uuid": "72ab93d4-4beb-4f04-ae71-f548f38bad48", "comment": "Malware payload (Dridex)", "value": "17685df507455b7ff5bb89458bee10708588981fe28866dff8dcb475cdab78c5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410539, "uuid": "1a0dae16-9117-4a3a-bd0a-c69c7903ddef", "comment": "Malware payload (Dridex)", "value": "8476ff506e822787c620865588291be229c64d8d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410539, "uuid": "dacd15d7-e025-4c7a-9862-a24e79a92351", "comment": "Malware payload (Dridex)", "value": "99aef6c472ad23713a6ea91bef50b43ab8fd0abe5ee7c61e69d852a4545b4b3bc83d140e49e7f0722f9bfc6fa47a9cbe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410539, "uuid": "71929a5b-a28e-4297-807f-09a94c0331a4", "value": "CFF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410539, "uuid": "73c93284-c0a5-4ae7-98ea-b8281985ccec", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410539, "uuid": "4b0125f9-d3a5-4baf-bfbf-60cfc7879574", "value": "3072:Ae45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:l4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620410539, "uuid": "d06bccd8-fa5f-4a23-a689-bf5536225738", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620410539, "uuid": "f1026886-f465-4ef8-bfdb-13dc1c3adbfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410539, "uuid": "27f94315-ba54-4784-aa08-dbdbdeec82a4", "value": "2b9f954c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268b3d0c-af40-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620397562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397562, "uuid": "53ab56ef-5d3b-4171-a5da-1a8f1b659ac3", "comment": "Malware payload (ArkeiStealer)", "value": "d74c12e6619a1f5e11195a821bb41310", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397562, "uuid": "357b2253-6b8e-4121-85d1-1357b6033bae", "comment": "Malware payload (ArkeiStealer)", "value": "177b833837d5cf031a7cdce1c9ac93fe81b648e8f57092a6554ad10fabf78af1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397562, "uuid": "bcc9b261-8570-407c-8052-07a1705154ad", "comment": "Malware payload (ArkeiStealer)", "value": "f3301b91851659505b10536f566443e6b5a29bb4", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397562, "uuid": "03a42a66-b535-48a0-83a4-b72fa149bce4", "comment": "Malware payload (ArkeiStealer)", "value": "f59ca31bd60215db022fb27804196f53dae46407956ca8f8537c93194d44be61c23edf129ab54f90f2cfe281415e2ad8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620397562, "uuid": "339a532f-c3ce-4e6b-afad-19aa70c464c9", "value": "00D4E1307A50C035E4F71AF889BA92BD762C7EA1572450CB13E77BEE56346E4BC31286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620397562, "uuid": "b08e1b6d-5610-4ff5-9bb2-f53f02e01b17", "value": "c5944944647f897dc99e9f24f2d785cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620397562, "uuid": "19749bae-3fb7-49ea-8e70-cce2839d5bdc", "value": "12288:yxP8RL/nkoEiZhrkT2JzVwprA3foqzmEXqV8NI35H:Pp/sKrkTgiePvmE7NI35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620397562, "uuid": "e4305fdc-c873-487c-bd10-ff04cb2c375f", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620397562, "uuid": "f8994f5e-db7e-4f65-8a7e-dce2a7c8f022", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620397562, "uuid": "41986fcf-c7ac-455b-bec0-9f36ce27b9e4", "value": "d74c12e6619a1f5e11195a821bb41310.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c12ecf-aee0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620356458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356458, "uuid": "847fc327-0f3e-40d0-91c4-8e7be6722f0a", "comment": "Malware payload (Dridex)", "value": "ef6b7b0574d0645b456e247de98d2786", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356458, "uuid": "2c36459c-22dc-4872-a6ed-7f3416849c0d", "comment": "Malware payload (Dridex)", "value": "17ed920bc8fa58f473a295884f66990433981696c6973b3742570dbffecb9782", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356458, "uuid": "b29e4af3-c4c1-45a3-8084-bdb8e87fb43a", "comment": "Malware payload (Dridex)", "value": "25d548e20b800aab9af0939079e4f48f2f68aab2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356458, "uuid": "83cb69ee-360f-4974-bb2e-8f3dfb648bc6", "comment": "Malware payload (Dridex)", "value": "011fd946907ea818476ac4b867b0e5431fededbc4c95019a490f4c8ce1cdc683a4a367909b8e3918887d37f94351531e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356458, "uuid": "76fac12a-9380-4ca7-8980-7864fcac3ce4", "value": "28F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356458, "uuid": "ac5786fa-940f-4813-bfc5-8c0b66f7ae75", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356458, "uuid": "2e43b302-6aef-44b7-a5c4-a18a13a4fd5a", "value": "3072:oWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:o42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620356458, "uuid": "6f0cf6bf-7f8b-4225-8554-5978c9202201", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620356458, "uuid": "b2042037-9b7c-4c5c-bd79-4500784eea4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356458, "uuid": "2f643d7c-173f-42f2-b29e-3fd02683f8d3", "value": "ef6b7b05_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a922038-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404199, "uuid": "2545623d-e0f5-4825-bfb1-51d32749b4e8", "comment": "Malware payload (Dridex)", "value": "12319148768f7a09789d818911de573a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404199, "uuid": "c2a8036f-5bb8-46c9-bf70-1d994600f002", "comment": "Malware payload (Dridex)", "value": "188d5f5bbd152e747e2f180f851da8635407c45d118c262d571fd21f9d2ea998", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404199, "uuid": "a7036e83-20c7-42bb-8d33-c6b89d5ecc70", "comment": "Malware payload (Dridex)", "value": "a14ae31da569d4e8b7a1f81cdceef0861bd06e2d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404199, "uuid": "40277beb-053b-4640-a780-eb6ee8634759", "comment": "Malware payload (Dridex)", "value": "0332eb17cb1fbcda9e9fff1b8792f60361acf5d51ef4ce496b20485996ff8217672155af2003de140977f43d27e6576f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404199, "uuid": "5ba19486-09e3-453e-854e-8a2a4086a100", "value": "8BF3E081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404199, "uuid": "f14be882-fefb-482f-a55f-20a054ee7830", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404199, "uuid": "fbc883e9-ff0a-4e00-924a-a6dd34825587", "value": "3072:iBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHAh:iuXLcclWEc2HeSjNjGdegh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404199, "uuid": "be94de48-ce67-48c7-bb18-e07a27d65ec6", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404199, "uuid": "195572fe-97a6-4a86-a409-a9d5a49402a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404199, "uuid": "32238349-8512-4ae0-93ee-23dde6bd5032", "value": "12319148_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb8fd15-af18-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620380585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620380585, "uuid": "b317f8c2-2443-43bf-95e5-0e5e07c6fc3c", "comment": "Malware payload (Formbook)", "value": "972c8502ec6351a57fa5ae84fd39e185", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620380585, "uuid": "37363986-dbc1-43e7-955b-ebdca31c78c7", "comment": "Malware payload (Formbook)", "value": "1893345e891ce74b4cfd82071d82f7566e3c44d8bf0e7a33f4207aa8d941632c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620380585, "uuid": "8530aa0e-7000-4222-a533-1b4efd590894", "comment": "Malware payload (Formbook)", "value": "ea02ba185facd60978f365dae414326e920ec5a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620380585, "uuid": "e61a7ea2-b08f-4363-aae1-7d5cd4efc078", "comment": "Malware payload (Formbook)", "value": "ce960aababac96d51dc04b2cdfda3b0f955f3928bf6ca7d0763baec262678aeb0b2c67ec6a729e590c969418141cc8b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620380585, "uuid": "f5b90ef9-8c5e-4010-93aa-3334a5e9a616", "value": "11844A821695A8F5CBC97038E654C3D36DE4AF37362827A219BEB75B0835DC8EF0911C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620380585, "uuid": "39cc7ce0-518d-4b86-8804-56432f4ac043", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620380585, "uuid": "8c0c0f43-329e-4214-bc22-8985163efffa", "value": "6144:y9X0G4ThNXX5LjMxv5mR4h8nW5F0E0lXhC+k:U0TThNXX5UZ5mR4ineQlXhlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620380585, "uuid": "08bd2eda-006b-4292-9d94-510b742b2e14", "value": 402872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620380585, "uuid": "c5db334a-0ab7-482e-88e4-cbabab1d09b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620380585, "uuid": "9d01856a-5c11-47f8-a2d6-70e804cb4bc5", "value": "Order Euro 890,000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1499343f-af3e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620396673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396673, "uuid": "ea7f7faf-d261-41db-86b0-ba74dc42aac4", "comment": "Malware payload", "value": "40d5364e5df97ae95b267fdd7aae4150", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396673, "uuid": "e5520016-6c70-456a-824f-c5f59e18832d", "comment": "Malware payload", "value": "18fe0165e0bab3924a639b441cc575d2ab65a8129eadfd1019fe1d984258735f", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396673, "uuid": "835a87e5-c9d5-4973-bd6d-8ae23bc2d157", "comment": "Malware payload", "value": "2f7f27ecae7f9a3b16c9f6a53982a7458805c855", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396673, "uuid": "5d4e4c7e-d643-4368-b225-b171b36d967d", "comment": "Malware payload", "value": "44a8e0bcb2e9ee40a4f73caed9cee551eb6af233f198543c025c65888f4e396b85eb38baa48319d3dbadc07d38fa4a13", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396673, "uuid": "b605adce-efa9-4983-8345-7d54ff098ca2", "value": "ACE211058EE34950A3B3F46657CDE4097F9B84C74F8BAE243C4D529AAFA137493F4A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396673, "uuid": "b197809a-571d-4e9b-af5e-274409a3476e", "value": "384:VIoq47z2YEERHBL+B4z6JdfB7SevtTJJJ2JJJ2efveSPN788T:VIoq47z2YEMHBL+7XDPiZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620396673, "uuid": "669a5676-1667-4af8-8071-ce760795bec6", "value": 32869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620396673, "uuid": "9d4b0c8c-6b8e-4899-a4e6-12af699b9e23", "value": "text/x-perl", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396673, "uuid": "0f580f60-a397-4e0d-8c8d-90238826ee37", "value": "18fe0165e0bab3924a639b441cc575d2ab65a8129eadfd1019fe1d984258735f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b40d7ba-aed8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620352848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352848, "uuid": "e84ef75d-fbe7-4f71-866a-051c4e2a7ad1", "comment": "Malware payload (Loki)", "value": "6aa6c9476735dd059a94e2b4a140b1e1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352848, "uuid": "f2bf1511-5855-40b2-85f1-1b0896721bd1", "comment": "Malware payload (Loki)", "value": "1953bc442245c3ed8f53f92c10ee582a587980fd1e931d53bf32761917f7b4d0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352848, "uuid": "329aa4a1-c9d9-4f22-b56f-6c1a260e52dc", "comment": "Malware payload (Loki)", "value": "7fd303e9f4c747af09ab7f5f6e8fc7d045088b01", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352848, "uuid": "b29aeaef-f3c4-49c1-97a5-c513b39887d0", "comment": "Malware payload (Loki)", "value": "f5d9ef724d06f4b603e67f2267ddf4b6b47fefaee9005346b280e7444d823e9a13c5ee8f6eb374f72cb6b8c80fa370a3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352848, "uuid": "8e737b86-419f-43c0-b34b-adb4ba23168d", "value": "45E313E17AD350CD2C463A4355E3D340E98FFB28395A9CD9653A6F60EB286E1F22304D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352848, "uuid": "42ced07f-5af2-43ba-824e-8cebfb86d314", "value": "3072:YLoL/b/gksLH3LHf4sSi2h7VUooQcU9cB7DBzgAVynYDXAR8EA/Db:MoVsLrfVSiAVU1QcU9cB7Dny6XARqrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620352848, "uuid": "45bbd317-e5a2-4224-b950-21975c635fdb", "value": 146661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620352848, "uuid": "d0d69c1d-663f-406e-9190-db7e41d15e44", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352848, "uuid": "7c6b07ce-9025-4a3c-a36a-dd7e32387897", "value": "6aa6c947_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d51fc1c-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620385306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385306, "uuid": "3b5cb142-1e4e-48bf-8bbf-29d881b8e8eb", "comment": "Malware payload (Formbook)", "value": "069f4f64184f2de8ea2b59c8599e723a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385306, "uuid": "9385c085-e4b7-4f9e-bf24-cc25ae5ede39", "comment": "Malware payload (Formbook)", "value": "199e6cb2e7f907f2f9ff30a25edb130dd330a44fdd6873c83abd4731e2d5f262", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385306, "uuid": "1e72962b-3b59-4077-a464-fefb06d21698", "comment": "Malware payload (Formbook)", "value": "907048c49433bce35dc436aa534125b93987b1e1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385306, "uuid": "a5b29c9f-240f-42cb-81d3-52f1e07df569", "comment": "Malware payload (Formbook)", "value": "b371516273b763761b86aff97b4879ef641eedd4c41cabbee2942a098f9d814ca0070afd1261ed9e1cc8e3f4a5db86f3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385306, "uuid": "f14dac1e-8f1a-4036-b0b0-95015cdfd8b9", "value": "DED423ADB3F2177686A50E32C3A4CB00C995DA14C77A42537E23B7B78C8631E1275775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385306, "uuid": "8d901a61-9405-42b9-ac9b-8155b99020f1", "value": "12288:xnwnonb85j9f+MSLux/lScnV7s2txbHzv0E2I8mOvY6NOZut:xnwMmhJ9yCxbHwE2H1vY6Nqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385306, "uuid": "f38c3cfc-aa6f-4bac-bc5b-1e00a04eb14c", "value": 624415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385306, "uuid": "74fd2082-51ca-45fd-9b5f-42076e495ddc", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385306, "uuid": "f69683f1-7e6d-495e-ae39-ae5f866a0c77", "value": "069f4f64_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d2d303-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407198, "uuid": "af401e70-19a6-4340-9dee-6490001aace7", "comment": "Malware payload (Dridex)", "value": "9bf91c38f63bee18cc8bee0fe82c4cd6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407198, "uuid": "e5798dd7-a5c3-46b0-ad52-40acb6f68f36", "comment": "Malware payload (Dridex)", "value": "19a8ca6e15f253fd5ee55185c154ddf8ed8de436e60b87f82f05c510ac8ae0c9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407198, "uuid": "864c0c96-f2a0-4712-a627-69557a595e45", "comment": "Malware payload (Dridex)", "value": "4e05d7dd2698f62dd4fbb1e5ee7824f6820cf641", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407198, "uuid": "0daa76a9-3ac0-4759-87d8-3fbc28015e59", "comment": "Malware payload (Dridex)", "value": "d0ac1ca1748f1037a7e6539fa2ea39a4ae16c6e8a84fa63d58cfaefd9c43409bf874c32fa1d685fa7020edcf49134de7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407198, "uuid": "440c0b71-cdf9-4f32-a43c-2e100ed19abe", "value": "EDF3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABD96BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407198, "uuid": "2f603bf8-3bae-4c99-91b7-5d0513d13b70", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407198, "uuid": "8bb7a59c-2d3f-48fb-bbf8-e2bbe2178f3b", "value": "3072:TBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHit:FuXLcclWEc2HeSjNjGdeCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407198, "uuid": "13fd2263-6829-4d86-9de4-1c3940b0adda", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407198, "uuid": "d174b97d-7714-48a5-af71-b6d6e5a970d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407198, "uuid": "3c409224-4e17-4c75-91e6-c1c7486ab2e0", "value": "9bf91c38_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17761be2-af63-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620412569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620412569, "uuid": "9c032b8c-1160-47eb-a92f-e343f1e8cd7e", "comment": "Malware payload (AgentTesla)", "value": "ad13035d6645fe8f09e8c56bf9bdbc9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620412569, "uuid": "7209ba62-d9f0-4f52-850f-8f51ce8369b9", "comment": "Malware payload (AgentTesla)", "value": "1a21dbfde2e79bd96d2a4d26fda9d6434492d052d12628723546577b497e6873", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620412569, "uuid": "bb7eb012-5c12-4b30-8600-33aed889b482", "comment": "Malware payload (AgentTesla)", "value": "a56a73352734c53e12d8c4b51c52e94a8a1ae777", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620412569, "uuid": "d1ada316-efc8-4c0b-8b87-fb9bc475c985", "comment": "Malware payload (AgentTesla)", "value": "ed7c4a7ed79ce79158f299d020a0f4eb1dc824e0e88d0bc21977c9342c84c4808bca76813b93952061ad2e6aaf35b327", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620412569, "uuid": "9df9b0f4-1713-481e-acb8-968b7770987e", "value": "F515128CBBEC9E11CAFE5A755DE051410E77A407AC33E32D28EC65B51F233A08D157AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620412569, "uuid": "1494782a-d6d2-4e01-beaa-dce2e93add6d", "value": "24576:LXA190sB9CMRAGJseVuYwVZH9nqj1Bq3O:LXA1D9CUA090H9v3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620412569, "uuid": "28a8baab-68a8-45fa-817b-cd9c4f9c7d54", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620412569, "uuid": "3fd64ce0-0c5b-4955-976b-f526a85a29cb", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620412569, "uuid": "1d4cfb36-b7f9-417c-9a12-6abcc39438c2", "value": "Docuemnt_BT24PDF.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062c4e90-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403521, "uuid": "1f596438-f5d8-4236-bf98-4488d85123c5", "comment": "Malware payload (Dridex)", "value": "ad91bb2851ebea974d825cdb0bd77ca8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403521, "uuid": "1617fd7a-02a8-47cb-87d0-bd97d1a692c1", "comment": "Malware payload (Dridex)", "value": "1a66d957ae7d380ced9f4f5823df5b8230ddd84fa6d8de11a8c458df8e9ade63", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403521, "uuid": "ff10146a-d573-40ac-88fc-9ebfca440701", "comment": "Malware payload (Dridex)", "value": "0a7061deb6b96b4403dc3538ada1541b2d3b4df9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403521, "uuid": "11a1cc60-27f9-4afe-814c-6cc505e221f1", "comment": "Malware payload (Dridex)", "value": "86280031e6c89c5ff181998908e46691606f3fa10638d679e0244dbe69758b853bcb988ab4d328cb50c92238c14e640e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403521, "uuid": "836f803b-5c14-4a10-b78b-8ae658fc21fa", "value": "E1F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403521, "uuid": "d640bb96-dd7e-40ae-bb8d-921202a4a1f4", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403521, "uuid": "0e9ab3f7-5206-4cc7-b405-40515866508e", "value": "3072:0BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjS:wuXLcclWEc2HeSjNjGdeDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403521, "uuid": "a7cfdfe7-655c-4a27-856b-182cf0fad4c3", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403521, "uuid": "644e4ef2-3b49-41d9-9aeb-6e5b55c649e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403521, "uuid": "f1e04122-92c9-4650-9568-87620328d02a", "value": "ad91bb28_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b730036e-af88-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620428728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428728, "uuid": "05ead4fe-df9a-4c49-9970-4020373a360b", "comment": "Malware payload (ArkeiStealer)", "value": "75e3696c1fd8a5f7c9804fab344851e2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428728, "uuid": "9895c7a9-2a5b-4718-a7c6-7fd3f84736ee", "comment": "Malware payload (ArkeiStealer)", "value": "1adf152f864e7da78406dfb915fa968b6a98f9bf4978ddbb41e84711cc64fcfe", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428728, "uuid": "0481c2b5-c861-4623-87c8-0cce884a82e3", "comment": "Malware payload (ArkeiStealer)", "value": "78dd58217626ed43b76b36eff4291010f865fd52", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428728, "uuid": "9b78b6c6-1475-4d1b-9898-fa0e85b0dac1", "comment": "Malware payload (ArkeiStealer)", "value": "464cd95870777daf5169165f1415f8fc537e17d478554a0961a20f8615bc8ee8506a35dd5ece104aec50f6af7ec9bb7f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428728, "uuid": "1d7be153-ae5d-40b0-b9c2-1e0b405ed901", "value": "F5E4F11271C0C032DC661D7A4465CB795E6BB8325F118E8BAB8E27B9DF347E17B2134A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428728, "uuid": "704627b9-8667-4342-8ecd-2c1a767b9733", "value": "e5eddde3bc28318303bde004dece8436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428728, "uuid": "b364ac10-c23e-4925-bc4f-a51479dd57cc", "value": "12288:TEiw7VcYoUrtuOkEpIQO87mfxEN7wiXY8hYKopgogVJLmUx:TEiwRcYoUrsOkE3Zmfxgwi9cpgoLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620428728, "uuid": "bbf88db7-01c5-4466-836b-ea715546dd78", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620428728, "uuid": "d5c36df4-1851-48ee-a2da-31a5153c88ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428728, "uuid": "30871075-bb33-4de3-aaab-511eafaa72c5", "value": "75e3696c1fd8a5f7c9804fab344851e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72bda2e-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620414125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414125, "uuid": "02ae41e0-1760-4dee-875a-1f1f51b0b499", "comment": "Malware payload (Dridex)", "value": "c46b2afd1a86486bb76a02ca7a86700a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414125, "uuid": "b9fd4766-7a50-48e0-8faf-08004b48cb94", "comment": "Malware payload (Dridex)", "value": "1af860c89b147f8ab02c55cb3011be4fb9b53ea0b77194e48f8ef3d8db527f3e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414125, "uuid": "8bd2c6c7-3663-4371-9378-efa37925f831", "comment": "Malware payload (Dridex)", "value": "f5fbacaf38db57ac61336df802b76b8af5e2dbb2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414125, "uuid": "59cca3d6-a1e8-4025-a9cd-5d228b3ba227", "comment": "Malware payload (Dridex)", "value": "2d7c33b27cfdd9c1ccb73e788ab348bef702ec520e89976126c487a7174fb5c354a724ebd31648d4a6799481b93b71ac", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414125, "uuid": "ec028665-4201-475d-b548-1c706b4bd57d", "value": "72F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414125, "uuid": "690605db-9e4a-48fb-a4fe-1730ff0d67e5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414125, "uuid": "e0fddd74-68c5-46cb-8510-5898d2ddd7f9", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414125, "uuid": "2e430eb7-884d-4125-adce-8da7ac6162d5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414125, "uuid": "c2d48f53-65fd-4ecb-8baf-690d31732ecd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414125, "uuid": "8899fbe7-169c-46f6-b936-f6b29d0e14b3", "value": "c46b2afd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0484245-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403887, "uuid": "15ca66cb-1072-4994-abf0-ae21e2d7647a", "comment": "Malware payload (Dridex)", "value": "eb669b5129ecc1bca7596076a41f5f71", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403887, "uuid": "e62b2c61-b137-4396-9547-8525a53a2149", "comment": "Malware payload (Dridex)", "value": "1afd4a453b5b3eec06c9116b360287f5db6a64d4349230bea4026c394350e621", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403887, "uuid": "ba8571b3-3a54-4bbe-abe4-98abc25eb3ff", "comment": "Malware payload (Dridex)", "value": "310291f4169e333121acfcb1033d1766db230cd9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403887, "uuid": "ff316f2e-430c-4777-bf4f-cd7cd9962752", "comment": "Malware payload (Dridex)", "value": "018707113615a472650c692ac23550e32a84a80ad4c85a33a78b8e50c9c5d65c70f034bd9bdc97161efcf22ef2a84387", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403887, "uuid": "ed157e8f-436a-4e65-94cc-c3c49bbac405", "value": "83F3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403887, "uuid": "44aad58c-63b3-4f2a-bd56-0965e7db6437", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403887, "uuid": "0be943fe-90c1-470b-ae29-68d69076e1fa", "value": "3072:lBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eH/R:LuXLcclWEc2HeSjNjGdefR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403887, "uuid": "842bdf49-4f8b-4376-8a87-1ffcd329db3d", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403887, "uuid": "838eef6a-aff9-4c79-954c-d91751a6d87d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403887, "uuid": "6163e1d3-f6f3-472c-95fe-994d13986a63", "value": "eb669b51_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee85cba6-af2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620389737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389737, "uuid": "56acbc3b-f3fb-464a-9540-4e9979c3aed7", "comment": "Malware payload (AgentTesla)", "value": "6fc21917bcfe0f7fd9a6174f6cbd858e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389737, "uuid": "dc144a34-7ce6-448b-9732-2e6a1feb2079", "comment": "Malware payload (AgentTesla)", "value": "1b1d4d5e5d506d26803bfdfb9789b04d6b071bd8b8576e8351d2705b7c585619", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389737, "uuid": "34982d41-da27-41ae-923b-f0e743a946bf", "comment": "Malware payload (AgentTesla)", "value": "add5d65aed213d0c2c23b4efd84c261c0d358fc9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389737, "uuid": "429fb795-f35d-4b7e-a13a-07be39eb4848", "comment": "Malware payload (AgentTesla)", "value": "8674d928b648015b417f8ed11f994b080e31bdff3bce5ce302bdb0d95117eba9090b46f528dadd7108ae2cc0ba83a757", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389737, "uuid": "2d231880-a423-4add-abbf-10ca41f3cfe4", "value": "1DA42370027ED98307C2B666CB617359B23A992B36D721B44CD00FAC2367B987AF7355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389737, "uuid": "da33d60d-f5bf-4294-b183-ad6d18e687fc", "value": "12288:vDTHCIi5l/1giSDKKwLPrsw0nlXa9hK2NesK:vDOIaltgbRRDn5a9hZRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620389737, "uuid": "14aac94d-598a-44d3-8552-74f3d740c92d", "value": 480017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620389737, "uuid": "8f2da07f-f459-4789-99aa-8bc2065b5556", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389737, "uuid": "983c8ab7-26b6-42b0-a22c-8a86266f4c7f", "value": "drawing of Part No R5-892-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab22d94-af2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620389382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389382, "uuid": "2e1c62ba-ab8a-4392-9443-ea4071d5d9c7", "comment": "Malware payload (ArkeiStealer)", "value": "578b067be019ba2dc3a16b2d27cb344d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389382, "uuid": "baa50997-381b-4428-a618-295ba6411543", "comment": "Malware payload (ArkeiStealer)", "value": "1bc09e5ea891ad2771215f95b99915444e1f37128580362d879c2f85ec76d596", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389382, "uuid": "c5dee0ce-56e7-4884-af04-1c0d1d856094", "comment": "Malware payload (ArkeiStealer)", "value": "d6550178f7b5b9a3077c0c3d855abc6b5d0952b2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389382, "uuid": "83027485-2664-4cfe-8955-9d95726120bb", "comment": "Malware payload (ArkeiStealer)", "value": "c35bc5ea7e2d111654679369a674ba30dcc9c395d9c97ebb3d1e2b45c72364d1818904999c84ead3d38b277ec9b8e093", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389382, "uuid": "4fff64a7-3f38-436a-9df4-d5bfed1f329e", "value": "4ED4E130BA50C035E5F316F88FFA92FDA52D7DA11B2450CB52D41AEE56282E6BC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389382, "uuid": "c09d6a09-da74-4cea-a698-5a464075c609", "value": "cb2564e12ac5902b716e5e7af62262e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389382, "uuid": "01e00e31-273e-484b-a8c3-ab70a804db45", "value": "12288:1ZrrIt/TCJiP7rbmOWNGZYMTbetX4IlZoMdx7+v4mHyCIXCBWYswj:LU/4Ce+vaZoOjmLIGsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620389382, "uuid": "db3ccfde-4098-43b9-bd3e-cd66a8757980", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620389382, "uuid": "9bfede2c-39f0-4a13-9386-b58c05e5bdc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389382, "uuid": "9d56623d-6126-4249-9f73-9b03f50475a3", "value": "578b067be019ba2dc3a16b2d27cb344d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ff9fef-af5e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620410526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410526, "uuid": "30bb84b2-ea78-49bc-89ff-670a18de81eb", "comment": "Malware payload (Dridex)", "value": "c8c27ec7a42ef1f76385dbf3b1bf241c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410526, "uuid": "54d74427-328e-43aa-9798-63eaf6507003", "comment": "Malware payload (Dridex)", "value": "1ca6dd7ca922bef3f87320bb21bbc9b1ba94e9785830da6b6f703cbb2cff94a9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410526, "uuid": "fff80234-cac5-47c0-8e03-536be109f7ef", "comment": "Malware payload (Dridex)", "value": "61695305e3b1e3a59e2aa6482fccdf771fadfc63", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410526, "uuid": "107dec51-ba2f-4e38-9e5e-3bd67a552c4d", "comment": "Malware payload (Dridex)", "value": "08ae2414aa12d0b50583504914b3ca043445dc9208bc92463d76ac287df7ab8c7bff3c188ccaeef41909103e565347b7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410526, "uuid": "5bd903c7-6a6b-4a72-9a2d-4e8e764e8067", "value": "38F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410526, "uuid": "0ebba872-93f2-4a66-b399-0ae2af92881e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410526, "uuid": "6662b5bd-5564-4466-8d68-1d67f904b6dd", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620410526, "uuid": "132e3326-ad5d-44be-996c-dbc0d8cb2727", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620410526, "uuid": "10c58417-aaf4-4dc5-ab3f-0349b44d22b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410526, "uuid": "28bf8b45-4ca0-46d2-a4b9-858aa064b010", "value": "c8c27ec7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc303881-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407262, "uuid": "83691183-339e-4f78-bda5-88a13c68fd18", "comment": "Malware payload (Dridex)", "value": "68a2778c3a66dcf379a3e7708f647923", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407262, "uuid": "45b5dbc3-7aa0-4e99-bb85-48d48f0976ad", "comment": "Malware payload (Dridex)", "value": "1cc28696a3869cc2096de946242476024d33de6e11cc9bec2057b4353dc4eee1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407262, "uuid": "a4bf92f3-b150-4902-a261-148a21d08171", "comment": "Malware payload (Dridex)", "value": "52e86dd6a9996e940ed88fa3d2e0cc14a789af8c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407262, "uuid": "6ab78978-e62e-4a9a-9a1f-266fc733258c", "comment": "Malware payload (Dridex)", "value": "92290599f4a494a508badb757080f53f0f1ed4c14a5ba2a3719efcbe3cbe5b5a00909016fbbb5d593bf06e65cfc03680", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407262, "uuid": "0dd6a7ba-28ec-4b3b-87ef-2874ddf4ffc7", "value": "82F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABD96BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407262, "uuid": "67765388-4606-4267-a5b3-b828f2b020d8", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407262, "uuid": "1d3b70fc-60ea-491c-8c5b-3ece0da7954f", "value": "3072:gBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHit:UuXLcclWEc2HeSjNjGdeCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407262, "uuid": "79b7a6b2-c998-4198-978f-6f43347ba646", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407262, "uuid": "e5a3b44a-0c12-422c-adda-b88266c660c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407262, "uuid": "999a51bc-24ee-40fa-aad2-a5c136924f6a", "value": "68a2778c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39777dd9-af27-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620386856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386856, "uuid": "07bfb255-adb7-4b4b-8a06-48561060b77c", "comment": "Malware payload", "value": "9a6a3d525239eeb1ec1f5d33affeafe5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386856, "uuid": "7859ce6b-ee39-4489-acf3-6f42fad79d95", "comment": "Malware payload", "value": "1d340135d6b80bec4d8d002ea6c3acae8869c3bae781af00481fa48a18e2564b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386856, "uuid": "9c7c9c3f-fd90-41be-84f2-5b3b5ed8e5a9", "comment": "Malware payload", "value": "1ff0bb0ee8cd239ef3a192e74ac864ab6506d2ad", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386856, "uuid": "d1de4678-c7c0-449a-8c89-0a236324990c", "comment": "Malware payload", "value": "12219ceb564af87763a19a1dd798a122e621641ff7554d14d28f321d3a610c73e09220a374007e8e9a01326097ce3241", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386856, "uuid": "7337f99f-8a16-4233-a0e1-de81d5ba619f", "value": "3165DF2273DDC360CBB69173BF6973016EBF78654630F86B2F880D79A950161262D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386856, "uuid": "2f48441b-3ad2-41d3-b88b-097b02b555d0", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386856, "uuid": "ca6e1d0e-5f84-4275-9d44-cb8071a7589c", "value": "24576:5Cdxte/80jYLT3U1jfsWa0ym/5KYGa1qWvUhB0IJS8002iOsA2N6mdWsmQ:Iw80cTsjkWa0ymoDa0yUhfd+iOsA25r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620386856, "uuid": "a40171d3-0d36-4e43-9440-6ad9e0ea579b", "value": 1475072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620386856, "uuid": "867e1220-5570-4daf-962f-7f8a8050e22d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386856, "uuid": "e7fde3f3-c2ab-46d7-945e-354e76c0fe96", "value": "caidat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64fda179-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403680, "uuid": "98fc304c-8be8-49ab-97a8-0130c11d1842", "comment": "Malware payload (Dridex)", "value": "4edd28e10ff1b72c3e69e6813c7c52e0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403680, "uuid": "468180c4-010d-4955-9514-81bdb20c4a9b", "comment": "Malware payload (Dridex)", "value": "1d468bd4cc5bf3288fc13221c6f2a6a357777edf14f2c29b239f0b293d2ff70d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403680, "uuid": "9ad6750f-9b91-4b10-a309-3c8b76d188f4", "comment": "Malware payload (Dridex)", "value": "45298eaf61fa4360d041118636d690eafe7a7cae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403680, "uuid": "018cef1d-a94e-4ee2-8d1b-bb3326fcfc61", "comment": "Malware payload (Dridex)", "value": "f16dabe93fdbb2cee210c4a844a33d148411d6ae6597d734fb9011908806ab852ef2ee064e567bc26a351fabf77240ce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403680, "uuid": "a408bbf8-0a97-4d10-91b2-3c8f7041402b", "value": "95F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403680, "uuid": "9853d042-1236-47a9-b09d-4d503e9b6f6e", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403680, "uuid": "0f5d4791-a75f-4497-b64c-148dbce5cae0", "value": "3072:LBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjf:tuXLcclWEc2HeSjNjGdeDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403680, "uuid": "b0e8af42-3161-481d-8459-633dbd0a635a", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403680, "uuid": "141532b2-6f88-459f-ad9b-530bd5ce8a0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403680, "uuid": "3a337f3f-e757-4379-94ed-0e2ad90c6a55", "value": "4edd28e1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e29ebed-aec7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620345686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345686, "uuid": "abb6c7da-19b6-47d0-8ed5-db4291fe5716", "comment": "Malware payload (Dridex)", "value": "0cffa35a05a70b16f9f90da705a7b5b3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345686, "uuid": "5d7aa8a9-88ed-41da-8797-45f0fc87c2de", "comment": "Malware payload (Dridex)", "value": "1dfdcdd3cd8967d19d5a05f8084941c7ab8a507d7dc2d44242222262c176caa3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345686, "uuid": "901d37dd-3009-4fed-9ffb-9f56b32a4f0c", "comment": "Malware payload (Dridex)", "value": "7bcbae3b6416e89c9354d5d3507803901808e6d7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345686, "uuid": "ae2c0e17-0da9-4ba4-ade4-8135c7836bab", "comment": "Malware payload (Dridex)", "value": "fcbc0054c4c2010d8c2a55fd2e78bef1af82e371cc2bb20eb768c520fccbb5befe7f4a0efa1cf4fa7cfc490984772856", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345686, "uuid": "2e96d6f5-aa34-4183-b9df-9dab45530c99", "value": "95F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345686, "uuid": "58013d22-aa24-40e8-92f4-c1d0f00dc5b2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345686, "uuid": "5fb29547-4844-4c70-afba-f1ce87da0825", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620345686, "uuid": "823eda30-f7db-4870-ae4b-f7c164379afa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620345686, "uuid": "6fd9877b-926c-4257-93e9-3da00e0fdeb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345686, "uuid": "32b1a34b-dfba-4cca-a3bf-b104ba737c61", "value": "0cffa35a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f01e88-af37-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620393875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393875, "uuid": "5e4297df-3712-49ca-bfea-11ec0f424f25", "comment": "Malware payload", "value": "a838c7488d36268209dde3b2a0db01c1", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393875, "uuid": "c973e75b-d65c-418b-8f9b-0c473f638997", "comment": "Malware payload", "value": "1e0d375bc7e7632ef3be227fccb48dec7f7011871901d7c143b2f6b4ec947e3b", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393875, "uuid": "cab9eea0-e8e5-416f-8098-2c07730d2257", "comment": "Malware payload", "value": "931a907cafeffc864524066ca76e7c04716423b4", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393875, "uuid": "2cf9c47c-70c2-44fd-a523-f735976030f8", "comment": "Malware payload", "value": "c179b36a2b23c5beb35f30f4f9c1ee94442bc7ca16028160f4734d4a52d173e4845177eedbad2c98add8c999ec477923", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393875, "uuid": "09d9a2fa-5814-4cc2-8b31-fd7a0b6854af", "value": "FED2E17F225526A6C6B584B6174107E07B3A0FF6E347AC120A10C1F1C5575F97CA9FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393875, "uuid": "a699b6da-49e9-4910-81c1-7b1cd3a3a8d5", "value": "768:izNPv+jmciL1l3dLcyeI2XGO4W1bmEOe3Ydvjo4JgGlzDpUYsD:izN3qmFLP2Xh4W1GeQo4VqYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393875, "uuid": "4f12962d-301e-41dd-88de-03d5e228c58b", "value": 29992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393875, "uuid": "6922ff1e-81b0-4f8a-8c1d-93a5f6dc8369", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393875, "uuid": "84512390-7480-4ac2-940e-b6c291ebf8aa", "value": "blxntz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcec3267-af7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620424873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424873, "uuid": "282c27f1-72d7-4bf6-8e85-31946d9e9b2e", "comment": "Malware payload (Dridex)", "value": "5d86f3e8a049eea3d0e8041889be1b39", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424873, "uuid": "82939a75-0f8e-4a9f-abd6-ec65b59eb7dc", "comment": "Malware payload (Dridex)", "value": "1e1667dd3516e634b45c686dc1a642eaa9339117e079b3675acc5f77f672f144", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424873, "uuid": "b90c133f-3823-4328-b40b-a741fa740cfa", "comment": "Malware payload (Dridex)", "value": "117132e22942544136f131742e44fea4b9be949e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424873, "uuid": "7aa64cc1-4fc3-4f26-b4e0-e874bdc4cf90", "comment": "Malware payload (Dridex)", "value": "a7071221e04c876b216e3b5e38e1c16cab5a3e74b37a64465cc3ffd51a7162b5a38f47baeeb07861d12ad83c38d33256", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424873, "uuid": "576b0d15-ca72-4848-af6d-7b571c733b6a", "value": "75F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424873, "uuid": "89fa7305-e842-4321-b7ab-f41eabd66fd9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424873, "uuid": "3653764a-07b2-49b4-b831-ea6dfe273b40", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620424873, "uuid": "535153f0-db6b-4504-9dd4-342a1d144017", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620424873, "uuid": "63bd201d-4b7a-494b-976d-17dd4cbaeec2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424873, "uuid": "825abd1f-ca3e-4be6-b935-62b7e48cf7b8", "value": "5d86f3e8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bd246e-af2a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620388159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620388159, "uuid": "721d021c-0471-4a8c-b38f-89afc1121ae2", "comment": "Malware payload (AgentTesla)", "value": "dc5dcde38867379c9a1952ccec220f31", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620388159, "uuid": "d2edcb20-83e6-4d12-94b2-6c8460275f2a", "comment": "Malware payload (AgentTesla)", "value": "1e55ef0091a7dda9e255443b3904ac6cfc3218a318dbecbe3a4a53407d280d81", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620388159, "uuid": "ce55dd7f-d463-4341-b941-b6afc44a795c", "comment": "Malware payload (AgentTesla)", "value": "5608b5a0af2f0b55fac5c05ab9ea0bdbb173e705", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620388159, "uuid": "78e0e340-51c3-45ad-9d8b-bfdd8b889d15", "comment": "Malware payload (AgentTesla)", "value": "2365dd779fbc45fc22bdf589919e99761618ab07856a3eb6bddd968a116bab08ae7e2ba41750ec0619b35d703c761130", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620388159, "uuid": "9210c678-1a38-4e41-8c67-fe1ad4e6e21b", "value": "8AE402BE17E8AF14C4FEAF71659191471678A4064C23D32D1AEC74B61A33F60CE193BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620388159, "uuid": "8efe1679-e310-462e-baa7-cb1538a1e5f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620388159, "uuid": "c172e7be-9046-4150-83b8-635c36765325", "value": "12288:iVxGf8+d2yTuAsS0q5qgpdxDpNaUBo8w9GThKgolVZM:iGk+d2uuANqgppN1Boz9GNfOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620388159, "uuid": "15a081fc-2071-470f-8fc1-9a832d7205f0", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620388159, "uuid": "bb30f42f-c90f-4928-a095-7b0fc4a91347", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620388159, "uuid": "76bbf02d-3745-4048-b352-15943e31bc63", "value": "ORyN4cgpvvpr7xt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1b2d22-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404176, "uuid": "05eedee3-15c9-45af-b2c1-be8ffe893e38", "comment": "Malware payload (Dridex)", "value": "8a197f068aeb5348c5a8994578d831f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404176, "uuid": "b0f698da-5408-4504-91f9-cbacb3a15a3f", "comment": "Malware payload (Dridex)", "value": "1ea0294cd0a6b49db11526c92239fb76f4b491a9dde44afe2776d6e74d65bf44", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404176, "uuid": "03ae0c9c-768a-4958-ba45-97fe5a61a0eb", "comment": "Malware payload (Dridex)", "value": "bc5c0f34b010398653713273a38173f8d288e51e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404176, "uuid": "72587c27-aa97-48d9-baa2-65e92b4cf2a3", "comment": "Malware payload (Dridex)", "value": "2554f583d566615bb4c36512183ea79c0a431344b1962f82a4e0ada9a590d268a03ca68d2e5705812362daa0ef5de9c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404176, "uuid": "2fc4c666-d02d-4b26-a387-375114b0231f", "value": "24F3D081E78ED5E0FC075B333EA80EEF52310087691854E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404176, "uuid": "b57f33ff-c8c3-4a0e-ba9a-e50b462fa6d4", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404176, "uuid": "971e22fe-e9dc-4af7-8cab-09a5ff672c28", "value": "3072:wBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjr:EuXLcclWEc2HeSjNjGdeDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404176, "uuid": "5ae833c1-e54c-409e-9736-b14a2b0302db", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404176, "uuid": "e82069c6-d2d8-4eeb-be93-ee04fa225a89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404176, "uuid": "f25966b7-33da-4c27-9242-e5cbfff1c77e", "value": "8a197f06_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9df4d8-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404018, "uuid": "a5929f12-8be0-4b68-9250-f22eac4f6bce", "comment": "Malware payload (Dridex)", "value": "92bbb749e853248868a50bbfd8b51879", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404018, "uuid": "d8f6a75e-49fb-4265-89a4-4cdff8ea2c0c", "comment": "Malware payload (Dridex)", "value": "1f20738aa8644d9e3a57e4f6db8dcc9819c2e47e741bb85433a3082a91f9cf7e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404018, "uuid": "87060343-ca9e-44f4-8d14-caf731c33e0d", "comment": "Malware payload (Dridex)", "value": "07ba88d07060a90c1483d1684a75dec1a9f46dbb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404018, "uuid": "92eb2085-28c7-4ceb-8efb-6a3a56aa4416", "comment": "Malware payload (Dridex)", "value": "3c8a5bbf8a7a0d2bd982981c18b5e8df66ce1626752437df79d72571fea86a62bfafc16c868c6269ec347a9877dad0e4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404018, "uuid": "40e2bfad-b60a-4db5-860c-1ba964b31af9", "value": "59F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404018, "uuid": "8c0fb54a-d54c-438e-91e6-df1ffd18673b", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404018, "uuid": "d6e38d5f-16cc-47f6-a4ab-290b7eec244c", "value": "3072:iiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:heAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404018, "uuid": "73b4fe07-da6d-4a7a-8bad-8a17c7db9fea", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404018, "uuid": "a0181e10-48d7-4655-b174-feeaedd3eb07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404018, "uuid": "9dbc06fc-23af-4528-87b9-afdde43c72bb", "value": "92bbb749_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ea5401-af02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620370939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370939, "uuid": "5b042ccc-7948-4c79-a713-caa1da8c9fe2", "comment": "Malware payload (Dridex)", "value": "fc9e4a38af33c72a6435e89fac760ddd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370939, "uuid": "fdfc5ea5-4fbc-499f-ab33-f68f05e572c2", "comment": "Malware payload (Dridex)", "value": "1f23b31f7eb0f62eb29ea2df3b676daf79f66451212b204b53b4aa4ada965d58", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370939, "uuid": "609d5cc4-1435-4071-b4b6-450807482ccf", "comment": "Malware payload (Dridex)", "value": "7c3e5111b529d90012089101eadea5166787468b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370939, "uuid": "6dced92a-031d-4b0b-8c53-5d62f8422c14", "comment": "Malware payload (Dridex)", "value": "18ad3573df04ec6b9fca6542ddc6d73c996d694346d883071899c82b7ab40dd631714a86b1596fdd647c965ca8678785", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370939, "uuid": "01cd8020-2a73-43ba-8379-687b6a408998", "value": "D8F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370939, "uuid": "3993276e-3418-43e9-8151-12dfa145aa55", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370939, "uuid": "76ed7974-3e49-4514-9de3-ae90adba2f2e", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620370939, "uuid": "cf6fe1ea-e29c-4ed1-b898-3c1f27ac3d94", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620370939, "uuid": "4b367a4c-4763-4077-bc4d-5af5b1df15c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370939, "uuid": "687883fa-71ec-4f46-b403-e9f69da980a8", "value": "fc9e4a38_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef03bad0-af6e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620417655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417655, "uuid": "a1df1936-121f-46f3-823e-359d20eb4d54", "comment": "Malware payload (Dridex)", "value": "9c53ff34c73ae9fc53618bc7d960724c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417655, "uuid": "73b2b676-eeb4-4c02-a4fd-649f1fb8676b", "comment": "Malware payload (Dridex)", "value": "1f62b7cc9589a564281c8a718f4e2f2a5ac8c8c5f5c738caede3143d7f0cc86b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417655, "uuid": "a3bded00-b9d6-4699-b208-266b442a9485", "comment": "Malware payload (Dridex)", "value": "6cc615270b74d2e93d2ec234da06f9ab1e7d18f7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417655, "uuid": "4409b856-2c44-41a6-8f44-bc875f3fb83b", "comment": "Malware payload (Dridex)", "value": "1f26e124070a120570ed6ac8c1e5999523b1b06f9c3e0347ed150b6436dabb9a24aab4deb3535e4239e3eafd04ba314c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417655, "uuid": "17da2a1f-6e2b-4d40-8850-de7266c22ecc", "value": "E1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417655, "uuid": "34685bda-fc3c-47db-9940-a0ce6faac437", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417655, "uuid": "69dd4da4-96b0-412a-9ab2-3c24598fda93", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620417655, "uuid": "d022915d-17cc-43b7-b74b-ebe51b9a2202", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620417655, "uuid": "49d29ce8-c0f3-49f6-925f-9e7f3271ff10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417655, "uuid": "cdde66b8-7ec3-40ef-832d-50dcb6e8a70d", "value": "9c53ff34_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3d2ad5-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403368, "uuid": "a48de13d-2104-455a-967e-9f4f568c01ec", "comment": "Malware payload (Dridex)", "value": "031fb4a7577c452cf7b349b3c9e9fdf2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403368, "uuid": "1e28a1ed-22e3-4138-9be2-b0c17ca142a5", "comment": "Malware payload (Dridex)", "value": "1f6d04906cde7825fa0dd83640cd80a8ed4490b4cced22014c27805facf52c51", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403368, "uuid": "640bcbec-7b88-4e41-ab66-dc82c6f11f9c", "comment": "Malware payload (Dridex)", "value": "d2ca67ee8575c9c5a8f28af1bc994e5e4cd1e39a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403368, "uuid": "ee927a7d-fd34-4956-9e6f-7364d17a3a3b", "comment": "Malware payload (Dridex)", "value": "1e232e795156765b8240d03b6fe8970374dc620ae09f80c79dda96fe03a0ddf8dd20843d72630da2f91d4b0551dba8d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403368, "uuid": "bfa12304-47f3-41cd-89e0-f4fece72b25e", "value": "BDF3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403368, "uuid": "1a063e80-3ba0-493b-b6f1-b6a5a936a6e1", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403368, "uuid": "ef8d21da-a03c-49ec-b353-97b64c12a7ee", "value": "3072:NBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjf:juXLcclWEc2HeSjNjGdeDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403368, "uuid": "ec0628d0-293b-4842-8db3-8a2b7ebfed82", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403368, "uuid": "53e2756f-00fd-41d9-a2d9-378ce64157ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403368, "uuid": "3f79567b-e9d3-4291-a543-21adcf2ee242", "value": "031fb4a7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce71789-af37-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620393976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393976, "uuid": "544ce207-9a07-4b5c-a773-16d3ac8eabf5", "comment": "Malware payload (ArkeiStealer)", "value": "93c0d33bb0b95a0aef0735bf421d3442", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393976, "uuid": "889cae83-7c28-4b68-a90f-c24741a26309", "comment": "Malware payload (ArkeiStealer)", "value": "1f904f9d59d9ee7f52c1d88d9c99fe9764081c8e575d2c6733960a514aac296d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393976, "uuid": "89320913-c22f-4445-9287-c42706f93fb6", "comment": "Malware payload (ArkeiStealer)", "value": "c04d24c4be5d86e1b47ab4ca0ce4c081f6389cdd", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393976, "uuid": "f903a8ee-e106-440b-a659-467bc71d6bbb", "comment": "Malware payload (ArkeiStealer)", "value": "11917cfe8b69a4da6e21494136cb1e373ebda9f459dc831828e8c124a9a06fb55d7e5dbd1b734850e5d153872c36e1e6", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393976, "uuid": "ed4cb1fe-5422-4e55-b231-b0e12b3f14d1", "value": "39D4E030A680C035E5FB12F989FA937D762C7DA15B3850FB63C41AEA57352E4AC3164B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393976, "uuid": "ca2c62e2-0458-4af4-8031-416255baa3a8", "value": "c5944944647f897dc99e9f24f2d785cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393976, "uuid": "efa5233c-8634-46b4-9f4f-1f3e0fc6bfa5", "value": "12288:FmohLY/oqnoJ0p4i2jT3sasrEUi7poD0nJk7Zz5ZAyclLfxcR:lM/qk2jnsrEUi7KD0eZdZfcFfxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393976, "uuid": "6279b10f-ef67-45f6-92b9-8997e271a54f", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393976, "uuid": "d7a2554f-32d0-40ad-9bd5-0b6b69365921", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393976, "uuid": "03df7166-8925-47ff-abd0-b8a82ef81fb8", "value": "93c0d33bb0b95a0aef0735bf421d3442.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf971d21-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403859, "uuid": "770c07bf-bc26-418e-bf1d-192d6ad2e1ff", "comment": "Malware payload (Dridex)", "value": "7cd99f4ea8b468038c883bd15d24a59d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403859, "uuid": "a813c302-ecf6-48d5-a383-fd986f3d6c0f", "comment": "Malware payload (Dridex)", "value": "1f9d457d6200113debec6b49c1f62d7b538e45bbcbd2a1d70ffb3b58aff03483", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403859, "uuid": "f73e94bf-864e-4c27-9f23-0f795a479665", "comment": "Malware payload (Dridex)", "value": "f5c448f95e4ed6d155b6a1639ed08f0215192e7a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403859, "uuid": "325655e5-a81e-443f-8cf0-5e7665a26190", "comment": "Malware payload (Dridex)", "value": "84da4a30e57c6220bc5421bcac2cd0bdf4b7a354287dc0f739d4a696d67042b12014c36651991f71613c7ef2475e8d91", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403859, "uuid": "b5d0d28f-a0b9-4c69-86d6-3166c3284556", "value": "64F3C141C9C5CCF0CBE36C3A4695963B3628B941995A8E42EC24CE3F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403859, "uuid": "ce86de74-cf26-4876-8493-4e33853f64ee", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403859, "uuid": "988bae7e-c321-4931-a9d1-8fffe2c14f42", "value": "3072:ZuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+3n:Z0czbty9uiaJlWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403859, "uuid": "4873295a-2f35-4fe6-8c17-cf859342012f", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403859, "uuid": "9fd91406-ee91-46a8-98fd-bdb955f2fc6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403859, "uuid": "5d73f020-2b5f-4bda-81b3-53744448336c", "value": "7cd99f4e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35346c05-af1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620381695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381695, "uuid": "f074bcca-9549-4ee1-8607-0222a827c0e6", "comment": "Malware payload (Quakbot)", "value": "4f2f1aea7e0fe7d9fb9503e8ef5b8e7b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381695, "uuid": "55003498-e453-417f-94f4-0aec2131dff6", "comment": "Malware payload (Quakbot)", "value": "1fa4fa134383aba2a663d6e3841f531cec8b750f2a857940b22bba1572e25f0d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381695, "uuid": "d42b4d49-4728-4bf5-b6ed-4e6d26766f22", "comment": "Malware payload (Quakbot)", "value": "3d071cb646e48ee4fb247cc597c6205fc67d5360", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381695, "uuid": "a1a668f3-cc44-4c4b-9ddf-1e0cae5376d0", "comment": "Malware payload (Quakbot)", "value": "463aae43b0c60f7852359615e6acd57084ac658a096f6c24cf596350c29a10aaf80de842756b79ec147c43ee05036d96", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381695, "uuid": "4236dea3-1881-458d-a7fe-d0a138f69270", "value": "C915336912A31979843FDB6B03716A7E468D3C4CFDA1C75B7119CBC80159EF206BAF28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381695, "uuid": "12ee1813-71a5-4584-9ecf-4c4f56af55d4", "value": "24576:UgjIhtigXpkkRHDiuf1geSWbuFxh340A4G8:PjXgXpdFQYuzp4/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381695, "uuid": "d3365d84-e13b-4b48-b668-4227860863e5", "value": 915898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381695, "uuid": "7975c6a8-0468-4fdf-87f5-e960ffb53d55", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381695, "uuid": "acf6e781-3ed8-4f61-8186-12625b1a3d02", "value": "4f2f1aea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbac4749-af2c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620389330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389330, "uuid": "f00d9ebd-75a7-4248-9463-23e168d2e784", "comment": "Malware payload (AgentTesla)", "value": "3a6c70310fdb23071705fcba297c8327", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389330, "uuid": "d527c24f-0412-4f5f-9963-0c6e0a2b536c", "comment": "Malware payload (AgentTesla)", "value": "1fa58485468d5b1461c56eb7412642d91401cd54252cc8545614dd88fbabf2e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389330, "uuid": "f7c892f2-ba77-42b9-947f-73b9807a7fc9", "comment": "Malware payload (AgentTesla)", "value": "da0513550c158ec7f7123e9e05511ecdd44c30b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389330, "uuid": "e1a1c9fa-f52e-47fe-a093-4d86fab5ae4d", "comment": "Malware payload (AgentTesla)", "value": "36591ffea278b061b01dfc141d9552f9e45283ab2c97155a4fdfa5d230a3ba92cf9fb2c8e920e14c0de3a27b9166ffe1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389330, "uuid": "3a92bde7-67c0-4af2-b3d9-ce68adfdff98", "value": "3205E0262385EA60E82A4779D05053F013F2BC11F722EE1BAED57DED7876ED182952C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389330, "uuid": "b97d9ede-db2b-4b29-9672-0db280dae759", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389330, "uuid": "0a9fdcac-a693-46e0-9f86-399126e65fe1", "value": "12288:8DYPMdUmt/AsGQE4Gve/9TgbibjcPQ+KK29PSB7LG0F5qRVRy6N:8IyUA//wveimvcP6D965K0F5qRyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620389330, "uuid": "f1d5057c-226e-403b-b86b-cce81b5ddb2c", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620389330, "uuid": "be0456c4-a7cb-4956-b836-54b1a70a0e74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389330, "uuid": "af63b0ea-118e-434f-bab1-41b32e3f1d6c", "value": "RFQ 11054.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682707ac-af77-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620421294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421294, "uuid": "eb00bc95-34e4-4370-a114-34a3a637e546", "comment": "Malware payload", "value": "2af99b670414f8157fdadf7cb343d472", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421294, "uuid": "a8388981-c966-40da-a398-fd80b7be07e6", "comment": "Malware payload", "value": "1fb31a1489acd9c1d9f0b9a584f9fabcf0963a8c61e450362507cbce23e93b51", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421294, "uuid": "17c8a2f9-f4e6-4e98-b4f9-a84b3bbe7f71", "comment": "Malware payload", "value": "e49e19fc5c3ffd61cdf7e8d611e07a754105d48c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421294, "uuid": "67b4e5db-211d-4c20-b9d4-7ef09c6987c0", "comment": "Malware payload", "value": "c7f090d2a4a3e774a93df6af5e675c42a9c3691b1629a78a840e1d0585304495cf29bfc1a6cebf71b2b4cd1299b004dc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421294, "uuid": "ed246d49-27db-4d6a-8ab9-919e09e394da", "value": "06F3C141C9C5CCF0CBF36C3A4695963B3228B941995A8E42EC24CE6F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421294, "uuid": "537fbb9f-8927-47d6-a79a-6aee6cb298f2", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421294, "uuid": "dd7e7877-556d-45d2-9845-334fdb5fdf94", "value": "3072:GuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+34:G0czbty9uiaJlC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620421294, "uuid": "009586e4-baea-4149-b05a-803338e2b84f", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620421294, "uuid": "827f0616-e55a-4441-92db-a3b07894e37d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421294, "uuid": "ee00f2f3-b5ad-4ce3-b6a9-d6bf3ced4600", "value": "2af99b67_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d18c8a8-af01-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620370568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370568, "uuid": "675747c8-a536-4981-87f5-b4ca3e7ac433", "comment": "Malware payload (Loki)", "value": "883e60554f4e20b5a1a06865d6854f66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370568, "uuid": "ca243ab0-5252-4a8d-a80c-e19dda411e44", "comment": "Malware payload (Loki)", "value": "1fc1fd8c6222445fb1064c4658c93a1bee4319850f1a06a4860521f5cb4ce009", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370568, "uuid": "0482008b-2a87-422e-b11a-2d1ac6d741ea", "comment": "Malware payload (Loki)", "value": "fd25d0276457311914347980f614d08b8f8e7f6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370568, "uuid": "64a479aa-aabf-432b-9941-4c197d8b8533", "comment": "Malware payload (Loki)", "value": "5808dc818384a7324a3b0b06f205487638be8dc7c1b02c900b51249910965cacf21698f7d2020c82af019cd939842098", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370568, "uuid": "970edf99-2e13-45cb-aea5-270ee5986d5c", "value": "B7F3019B6290C9F3C5710671153A4B6EBBFB9E9868B65A0B13C47EA53FB3893051F403", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370568, "uuid": "b037c6e8-af45-493d-9044-43010c45c288", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370568, "uuid": "f30d8be6-3603-4336-881d-a9fe2f65f65c", "value": "3072:jf1BDZ0kVB67Duw9AMckzkT/5Dfri5g/ubkAxrGx8vjHb/6q8FGW4zRK/7hKuYin:j9X0G4/NGx87Hb6q8FGXK/78iAr75m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620370568, "uuid": "c5335b6f-4994-451a-8741-53b31de541cd", "value": 166369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620370568, "uuid": "20f761e2-2475-417e-91b7-4c599e6864cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370568, "uuid": "8d415cce-93e8-4a08-9707-f6264842c5d9", "value": "Proforma Invoicepdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea18625-aecb-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620347539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620347539, "uuid": "a5eca8af-8bc7-45fb-8345-7523ce477d67", "comment": "Malware payload (ArkeiStealer)", "value": "fe4f2e6ac9d376c90381aa0d76e4ceb2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620347539, "uuid": "acd183a6-070f-4e7b-a2a2-5961eb54c357", "comment": "Malware payload (ArkeiStealer)", "value": "1fe1175c82ffe146bcf31adaa4e034e58b23dfc68361367983cb9cdf0e277e66", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620347539, "uuid": "a8026cff-8b51-47be-b14f-7b4fd7540dc9", "comment": "Malware payload (ArkeiStealer)", "value": "d2422dbbd520a1613b5f0fa445f807594e291de5", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620347539, "uuid": "51a8ca43-f70d-481d-a068-af8fb9de2374", "comment": "Malware payload (ArkeiStealer)", "value": "8de2cc62d49584df5a65426c9d20203309a156c5079adfce55fd5b7cf870cf9a447878c1c966154e6d3eaafa69959498", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620347539, "uuid": "c90a60ba-441e-427e-ad72-690f451da345", "value": "50E4F162B181C076EC5719729825D7B04E6EB86217612AFB2BCD37F9DF342D0763630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620347539, "uuid": "88af7951-3702-4281-ac7e-84771c3197e0", "value": "08a879d554c99744f28f371eb1c590a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620347539, "uuid": "60b2656b-16e0-44ce-b7a6-1daa27f87121", "value": "12288:nvwUpPz/hpevpeFCSdrSQk7QiJiSF3lvwiXzmrqJ:nvwUpPbCpAldD6dF1vwiXzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620347539, "uuid": "39e33ca9-5a10-4648-877f-9c72655899ac", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620347539, "uuid": "e9c4f4aa-7946-4ada-9a1e-b3e6b2109f30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620347539, "uuid": "5dec17b0-84ec-4328-973d-9eb34cb1b0b0", "value": "fe4f2e6ac9d376c90381aa0d76e4ceb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645bde09-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1620392512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392512, "uuid": "f3bbab4e-3d3a-4da1-ac8c-24fe23c85cb2", "comment": "Malware payload (SilentBuilder)", "value": "6249ef10b562faaa194e510223fbc2ef", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392512, "uuid": "9eb04ce8-9bbc-47f7-b2b7-c58d91e6b480", "comment": "Malware payload (SilentBuilder)", "value": "1ffa45b3428610695d158e716e2bbedaac0168103f1fbbb1bc8cd4f8f950319c", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392512, "uuid": "184b8dd2-51cd-44a5-822c-ea597a48e537", "comment": "Malware payload (SilentBuilder)", "value": "6fe72201e9084cd867fc968f13bba342e9d41c60", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392512, "uuid": "cfb3de64-bb31-4c0a-acd4-4ac199457745", "comment": "Malware payload (SilentBuilder)", "value": "bf93aa7640998ff3e5f43d553d98eb25f69a41cfe414e15613fd20565d96104dc61b9af867a84ba7069b6ec6a806cd4c", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392512, "uuid": "e2f78479-b0fa-4422-a945-efc3cc1652d4", "value": "E054B492A112A5E4E5581F36E82245FC43E7EEAA7B18F1CB2C0473B73B771E12EC1519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392512, "uuid": "70073376-82e6-4170-a49d-d44351dda92e", "value": "6144:/cPiTQAVW/89BQnmlcGvgZ7rDjo8wB3c5JK+MP2r:LAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392512, "uuid": "50074f60-b6e0-4ab7-a176-8d87c41bf972", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392512, "uuid": "2684ba8a-5326-4709-a542-deecdbd27542", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392512, "uuid": "4fc9b63d-e8e5-40c2-a415-f80dec2f7372", "value": "6249ef10_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466d6f62-af44-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620399333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399333, "uuid": "c53df91e-e8f2-4227-b52d-ee70c77d25cc", "comment": "Malware payload (Dridex)", "value": "710cf08f13c9ebcc0c3604ee82d984b1", "object_relation": "md5", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399333, "uuid": "35329e48-3bcb-4756-8bbf-57f6876d41a2", "comment": "Malware payload (Dridex)", "value": "200f05393dbba31613773c816d397c19ca9694e4707bc5b22990671c8da38d0f", "object_relation": "sha256", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399333, "uuid": "b498a4a8-8d82-4c09-9850-64846e20ef60", "comment": "Malware payload (Dridex)", "value": "05795fd74c313313d01b0f5c39ae1357295b08da", "object_relation": "sha1", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399333, "uuid": "4e7c21f3-9c91-49bc-9d0d-bfabaf7b1cc2", "comment": "Malware payload (Dridex)", "value": "c93d6e9b90c5b2c3413e74457fc643eca1cc71a66c4fdda8bfa566cd84a1dd6dd235f08d3261f9fa362b0f9139a50405", "object_relation": "sha3-384", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399333, "uuid": "2b1d81f0-5b7d-4a7e-b32e-27da3855c0c3", "value": "2733E1AAA5B45C97E1B4CB7802AE39C66DED3665D1A390A12B8D74FF030431742DFC4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399333, "uuid": "d9ee85e3-21c1-427f-a803-e0e3797d16cf", "value": "768:GeuafWHawQpapwt0Nxjg9GF/Q1U4vSJ4HNQv2iaUrlJvFcjT3/IgEJUZY/7m+2Oo:GefWtxjJN1I1Qeia6F8oN7mL+Nu1TwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620399333, "uuid": "7cc18a4f-54e6-49fd-8afd-5348026c52a9", "value": 53011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620399333, "uuid": "25f9cd77-421e-4f59-b3fb-1b03a7f3fe5d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399333, "uuid": "5dafe0c3-1654-4970-8884-ded9de909de9", "value": "generated order 67612.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d20817-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407382, "uuid": "3525be1b-1f84-4eee-9c4b-06d189483644", "comment": "Malware payload (Dridex)", "value": "8412fdc0a60f4e791fefc134c97369ed", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407382, "uuid": "a0c34561-762c-427b-8a53-0a7dd16e837a", "comment": "Malware payload (Dridex)", "value": "20559b97d079fd22366587d29051e8b675243edff5a310179c375e912d444c78", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407382, "uuid": "c1585786-f923-49f9-a556-a229e3b01cd4", "comment": "Malware payload (Dridex)", "value": "dd18d7d86bdf98a3370060b03c099494706a65a3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407382, "uuid": "1127c575-7f6e-4123-bf65-cc1fbb00ee9b", "comment": "Malware payload (Dridex)", "value": "2f3373bfb86acd9d4aa0b59b900b0e47192c61f7ab9b1074cfaade5df4846302d695a70d7b1d080675e92ceaa857a3f6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407382, "uuid": "0a3ce4c5-4c73-4f5b-a505-cadd4ae4979d", "value": "83F3D141C9C5CCF0CBF36C3A4695963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407382, "uuid": "9b2deeea-d8fa-4d2d-9d4b-d7169e63de2a", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407382, "uuid": "9ea3bb62-c7be-4107-8fe9-a38069799626", "value": "3072:BuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+3l:B0czbty9uiaJlCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407382, "uuid": "62bb3f08-e427-4c9a-bec6-a216d278ac55", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407382, "uuid": "b6030f5f-ca1d-4364-aa4d-349c5a7e0b2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407382, "uuid": "47746bbd-4bbc-476e-bfe5-8d4478d4629e", "value": "8412fdc0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a53023c-af5d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620410131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410131, "uuid": "3682d652-c093-4c8a-8aac-0ce5fd15c07b", "comment": "Malware payload", "value": "e667d819310c8cb76c2a67b2d74d7926", "object_relation": "md5", "Tag": [ { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "upxHook", "colour": "#884C41", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410131, "uuid": "62cba29b-aa68-43ea-8ea9-4237908122f2", "comment": "Malware payload", "value": "208000cf38921346c9b163e5ab4607de5bb5158ff5eb9765989d07f7d1c4593b", "object_relation": "sha256", "Tag": [ { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "upxHook", "colour": "#884C41", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410131, "uuid": "e0388afd-5372-422a-9482-5e24c6a4b504", "comment": "Malware payload", "value": "f04bc2ac4694b0f3d3d1471cd5ba5c70313f7161", "object_relation": "sha1", "Tag": [ { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "upxHook", "colour": "#884C41", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410131, "uuid": "3c52be17-992f-4228-aa06-9a20451fc2bd", "comment": "Malware payload", "value": "87bbddd161c2aaead3a149b3e165c9c31a15de95992156126340107dcd4676d4fee1fac1d4d529b6deef4a3ba4c91f7f", "object_relation": "sha3-384", "Tag": [ { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "upxHook", "colour": "#884C41", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410131, "uuid": "dfccf68c-cce5-4a1c-8c7e-1a2f3456a428", "value": "C28533FFE0AFF171C85F0276481F77CA909CA051FA8AC2B2E756B848D9B10EC5574662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410131, "uuid": "0bcd286f-caa7-41c4-b855-915298f0dce7", "value": "49152:+S2uXc2k60EzZzbzBIVaA2RD/ZSABqA1IoxckObluc8:+KXc2FtpAaiQN1I1Buc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620410131, "uuid": "dbe0fa98-4811-40e2-83d8-71d54dd1209f", "value": 1728840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620410131, "uuid": "850f0e7a-d441-409b-bb4e-c32aa027636c", "value": "application/x-mach-binary", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410131, "uuid": "0b9e5098-cc1a-48bd-8284-3e82d5c9d186", "value": "MacOsTest", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf98afa-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620385334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385334, "uuid": "3d43bd5f-99e7-4e84-bd83-a3b5b922cf7d", "comment": "Malware payload (Dridex)", "value": "054ceaac00841181c952671fd19fb275", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385334, "uuid": "dd1724b7-e2bf-4ffa-9535-a07d0ff7d0e9", "comment": "Malware payload (Dridex)", "value": "2089709b2748a7e28d00fcbe808f1a23e3018d10734f2f9bd294e0189ad5fc2d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385334, "uuid": "42bfa2d3-475d-44e2-b7fe-9ae92ee0e48b", "comment": "Malware payload (Dridex)", "value": "7a5ef0c7a32495e8bdc44d5ccd7943a60433311b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385334, "uuid": "6d739d51-64fc-4ca0-97ce-7f14fbeba9e2", "comment": "Malware payload (Dridex)", "value": "730a0c9633fab6b2b61a6086a739a1d182bac25f52fe02cf32c9ae9a24522443bcd07c320188983167093fa692bf9343", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385334, "uuid": "921d106c-b5c8-47e8-8454-14f848de7d62", "value": "12F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385334, "uuid": "2fd001f5-4f90-45d6-a07f-f57613055133", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385334, "uuid": "ebec28ab-ccf8-4c4b-80d0-0b093b11884c", "value": "3072:AIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Zc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385334, "uuid": "3a3d2e95-4fe0-4485-ad74-2c0571132c3d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385334, "uuid": "e958fc73-cd1d-4766-bdf7-5970f7d5f417", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385334, "uuid": "ae4fc8f6-f83d-4b1c-81b8-c65bd4049c1c", "value": "054ceaac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ce4495-aef3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620364469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364469, "uuid": "bfb28547-ed0d-4093-a546-4eec35968e5b", "comment": "Malware payload", "value": "d85fa430d20b69ef8fcdfb730a778872", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364469, "uuid": "3a1e7dd4-b6cf-47b2-96a1-7393df54b9c7", "comment": "Malware payload", "value": "209a212d509972a2f328db4d67172fac57cc401b6ebc4c1dab3390de85bd2131", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364469, "uuid": "d022b641-f498-41a6-8ed0-87800709143c", "comment": "Malware payload", "value": "068b5e3a091b41dbbe3e5ba3dfaa574611d492b3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364469, "uuid": "6b20c318-79da-48ab-9092-3d7bfc0e2c00", "comment": "Malware payload", "value": "9f244ec190b1e89271dcb45e68fb2b1a20633987be10c1c3e733c92f2f0940eef5a068da73d140c946a07640a7c04f47", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364469, "uuid": "97219541-ef5f-471c-958a-1eef7111253e", "value": "2E51FD9B87858D67C22E577801D34923B97B55306333430F0F6443567531240ACB0F4C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364469, "uuid": "0c3c5ea0-035f-4499-81ae-68d1b5afae24", "value": "d2d80b7d24d4b98faa43b0ad54469ae9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364469, "uuid": "e3fc289e-b328-4658-923f-7eed223a2854", "value": "12:etGSGs82Q3XsaaGPGdY4q43Rwx226OuBL/zZUl0MoloZqhxe1xC/a2lQ1U:etGS438Sg9mxJSBDOb2xqCC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364469, "uuid": "43300d5e-380a-4397-92c4-80b26f140e84", "value": 2560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364469, "uuid": "433ac992-7d89-4403-b88d-ddc76103fb23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364469, "uuid": "40c4d74e-467e-4ba2-a866-eed753af4a18", "value": "GrabTest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6aef7e-aef9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620367369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367369, "uuid": "62e7365b-aeae-46cb-b4d8-849ecf5a1504", "comment": "Malware payload (Dridex)", "value": "c1082e1ec1754835ef6d64a64a85503e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367369, "uuid": "dda75cd1-da45-4e57-b484-82c8df87bb8c", "comment": "Malware payload (Dridex)", "value": "209c76d39ab018f1701357a3b4d6d4c579ffb51baabbd047becf408168dc2ae7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367369, "uuid": "cf84d264-5453-456e-aa02-9ccde93cfa6c", "comment": "Malware payload (Dridex)", "value": "1f9c372dfaad970c5b3234ad35dd7ba6d0ca8fbb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367369, "uuid": "677b57ee-2591-4fee-be99-58ae826f8f42", "comment": "Malware payload (Dridex)", "value": "6764fc4f0ea75f54e2b48e23f03a8435a7b5fa658160f7e61cd3e3e9757cc214394d452c49a8c7532688a172d4272ee3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367369, "uuid": "a517e2d8-74a1-434c-a4a3-7fde75ebb905", "value": "9EF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367369, "uuid": "7510476d-fb4e-4c0d-b61d-8e9189dc4175", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367369, "uuid": "75f2e267-d47e-41b1-847c-6dd5054334ed", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620367369, "uuid": "13a8fd66-e2af-4eab-9525-9fae2d21b421", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620367369, "uuid": "5484c261-25e3-4b52-bd1f-5a904abf2e57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367369, "uuid": "a995469a-6526-4c86-9b6b-52ba4506eacf", "value": "c1082e1e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be0b506-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407100, "uuid": "4dee124d-73ba-4868-ba4e-d78c981f68f2", "comment": "Malware payload (Dridex)", "value": "98d91f165b690df711c59197227b40a5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407100, "uuid": "a1289a14-c8f3-4a3c-8277-8393053c6f73", "comment": "Malware payload (Dridex)", "value": "20dc61779a9e93f5a44191c52cb29113d0112e5885d94ac72177fda0723af6f7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407100, "uuid": "0f2b9cb0-6353-491b-9df4-4d1487fe4be6", "comment": "Malware payload (Dridex)", "value": "8037db4becc0d22f47edf6e56e26e0ef6b739773", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407100, "uuid": "88900950-d96a-4e5d-a121-c5c4425fac09", "comment": "Malware payload (Dridex)", "value": "a54bec87dd685f0cb830182b196e3f92259d1cfe09288089cb20c0929ee6d193d92d4722a8ef852d9a3112c81e830791", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407100, "uuid": "fcd433e5-8659-4776-8287-d0ce53964771", "value": "24F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABD95BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407100, "uuid": "b43cebbd-2b34-4461-a4f2-e5f8754b135a", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407100, "uuid": "784e41b9-4f8d-46a1-a26e-2711f98dc112", "value": "3072:WBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHtZ:uuXLcclWEc2HeSjNjGdeNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407100, "uuid": "da89340a-0b5b-4d14-a95d-8a41fd485ae9", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407100, "uuid": "97410f07-69d6-42d1-b3c8-cae35708268e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407100, "uuid": "4fe6e4b7-637d-4ab8-8b6d-b1c2ebb7522c", "value": "98d91f16_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df887e6-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620406996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620406996, "uuid": "f2e1851d-3554-442f-ae8b-c8276cb406c7", "comment": "Malware payload (Dridex)", "value": "dc100ddf4282529f66e6d6a1b89f94b4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620406996, "uuid": "9af59613-2bc2-4ac6-bc50-77417a736bdc", "comment": "Malware payload (Dridex)", "value": "2112923130900aa7a4721979ec40e2bb3664a6d06c53708e5e5027a62c9e2bcf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620406996, "uuid": "cdf9c56b-c8d8-4bba-94e4-88687b820cd6", "comment": "Malware payload (Dridex)", "value": "d9e4580f4912426d38b9adff5468ca03e376a1cd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620406996, "uuid": "22a7dbb8-0b8e-42f3-a042-c5196794e303", "comment": "Malware payload (Dridex)", "value": "0ead3ebf40d9a536fe903824079523353ec019fb6398e1337919958d8be55d7a6c3c001638545aa64eebccdfef006748", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620406996, "uuid": "e0352cfb-c6dc-494d-84e0-1fc5dd20197d", "value": "92F3C141C9C5CCF0CBF36C3A4695963B3228B941995A8E42EC24CE2F615F3F1F95A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620406996, "uuid": "aacec61f-9f63-4ad6-8e24-b0941de9d0a9", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620406996, "uuid": "3305979f-551e-46d5-94bd-e425addf0113", "value": "3072:FuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+jN:F0czbty9uiaJlqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620406996, "uuid": "0f4a11b0-5c44-4064-ad5b-fdd95f7ed037", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620406996, "uuid": "656273af-060a-4d75-a1e9-efd7b0ba3ffb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620406996, "uuid": "63b651d4-5606-4f4a-bd7b-91503fe3b9cd", "value": "dc100ddf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48bf6844-af32-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620391606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620391606, "uuid": "9b0f6887-7a05-43d5-bbd0-7c247736face", "comment": "Malware payload", "value": "7944390cb49ca5a3506c501d3baefc2e", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620391606, "uuid": "be6e0302-596e-4cb8-ab7d-2465a7aacec7", "comment": "Malware payload", "value": "2116db2813a5e945bfd759871a812d5fe75e8ace6f014bf042704d644de92064", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620391606, "uuid": "4e96c0f4-38dd-47c4-aff9-7e7d2159ef01", "comment": "Malware payload", "value": "b38c42928d987c0aa8310a0ca0f890bfd848c580", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620391606, "uuid": "043a600d-6369-4006-888b-0b7afc4c2e1f", "comment": "Malware payload", "value": "cc026f1bddc1c5c4af8179ee77803147ed1b69ddac98259ff4ea52a124fcf92f145f0ea442080b64d8bc72731b57a289", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620391606, "uuid": "c92e6348-f744-4da8-9ff0-d2a7a71daf11", "value": "33228E69D902FC1AC172007ED17C82B5F74C60B3E953B82C615972AE8B503A64B9F5EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620391606, "uuid": "6dc56884-5af4-4859-95fa-c1b4e1918e70", "value": "96:kHcIMm57P6o37s93dmGJa6T/n/jNTiwxReCBK8UXoG0zleqSyaltsULKfSqG58dK:ScIMmtP57Y0G/bswxcvgl30P2S6E31h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620391606, "uuid": "502bbd04-423f-4120-884a-b147e58f0150", "value": 10328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620391606, "uuid": "52fe214c-2107-428b-a1d8-4bacb7dc3dc3", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620391606, "uuid": "095e8395-eac8-449a-875d-fb2f4d40a01a", "value": "PO_P287712.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc03f66-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403936, "uuid": "749b6b4d-5e01-4bba-853c-69dc48ac5579", "comment": "Malware payload (Dridex)", "value": "820642e44dc581db10578287907deb7b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403936, "uuid": "beb85f14-5de7-4ba0-a885-d291f399c26b", "comment": "Malware payload (Dridex)", "value": "21a9308541867738a7c63b5eb27475aa3e3281fa1a90119d1203c94aff64ebcb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403936, "uuid": "8ec4d1cd-4a20-4c1c-bdc8-977693fa4800", "comment": "Malware payload (Dridex)", "value": "d8764ac30c2223e8d39f3c31a0c290b04f968337", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403936, "uuid": "b1a6cf86-0024-4d88-b9c3-e9d0b29296c0", "comment": "Malware payload (Dridex)", "value": "4b30af49a28bd79ad0b2cd5695f0d7bf25ca8b5d82fcbb5fd430d54c3abb69b97c6703057dd38bc3ac94952385667cff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403936, "uuid": "4fe22a1b-c841-4d18-b82f-35b85b5c02c9", "value": "93F3D141C9C5CCE0CBF36C3A4695963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403936, "uuid": "593dad19-c8ed-46e7-9c74-875b9ed82709", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403936, "uuid": "57971a3a-1d3d-46dc-bd01-4b2b17dd8d2f", "value": "3072:RuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+zG:R0czbty9uiaJlyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403936, "uuid": "ed7ec900-6774-49e6-87e2-b247535ec4ec", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403936, "uuid": "c4ec512b-5af8-4335-bd1b-38cd510d5581", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403936, "uuid": "26979cda-9163-4939-a48e-c232b3bf51e5", "value": "820642e4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb2dfd8-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392209, "uuid": "093dfff1-2a85-4ca0-abce-bc9aa82c0e14", "comment": "Malware payload", "value": "0d48fdd57e7606c877eba905c9a86d34", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392209, "uuid": "eb7dcb2a-9411-4427-bd0a-1de597813850", "comment": "Malware payload", "value": "22237ff4ddb58de4300b256185cf7f80adde90a6cccf22493f03fbdb372df1e3", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392209, "uuid": "502a6fe2-9688-4d53-ba5b-756b0198555b", "comment": "Malware payload", "value": "2eec9e3364ea307f8adcbc9fdebbed1fafe27d44", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392209, "uuid": "e2d677e3-ea12-4841-a2e7-d1b27e2bf9a9", "comment": "Malware payload", "value": "947e4fbd1f51cc1572eb81bc2212d8b3530750b66c43439bc5e339a8db1febfe5fb0e3f30e02fa1b5ff5ad4bb84ca84a", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392209, "uuid": "c7a7095b-2774-44cd-a1de-1ccb0e358400", "value": "8FA1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392209, "uuid": "f76c4258-6567-42e6-a05b-36a505680686", "value": "96:2RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:2RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392209, "uuid": "13b4cc4e-3b50-4691-979a-fe9472eff0bc", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392209, "uuid": "3ace6e41-7e19-4064-8922-57bc34614a90", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392209, "uuid": "68567fea-cec8-4ffc-a63e-484309f81f61", "value": "22237ff4ddb58de4300b256185cf7f80adde90a6cccf22493f03fbdb372df1e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec4be63-aee0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620356478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356478, "uuid": "0ebfa6ab-0145-4aca-973f-e4e0ce8dc24a", "comment": "Malware payload (Dridex)", "value": "8f43d281605d64c3a10a853ce38c510e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356478, "uuid": "c10c04dd-ece8-4351-af78-105f6c265f32", "comment": "Malware payload (Dridex)", "value": "22bb705a62600f9c7a73aaf4964c2de22fc14e4b2c93e8b7544af43eb283d743", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356478, "uuid": "0b20cace-6d2c-4f2c-a666-c8ce5e1887da", "comment": "Malware payload (Dridex)", "value": "8a6a1ad0f5674d56862f72ce5a96c4c1313ce3d2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356478, "uuid": "2b7f7080-eef0-4e11-bb2c-65f37d155e31", "comment": "Malware payload (Dridex)", "value": "464ed218a0fdb3cf95ae3ee3d0a305d3805542f30292dd78c136b3f9101d2b82ddd6958e4a320a59f5bfa0413b684993", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356478, "uuid": "e3410529-42c7-44b4-9fd3-c370ff8650cc", "value": "F9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356478, "uuid": "e7800a61-bb24-4576-9816-d4c74192ec75", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356478, "uuid": "a6c5aa54-bba0-400b-b5c8-c80d0221f766", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620356478, "uuid": "b8352e99-5014-4e1b-9676-d55a1d89b932", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620356478, "uuid": "ada195f6-9fb9-4e6c-a3c8-2199049687ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356478, "uuid": "3c4788a2-fd77-4051-aa49-487356a6174d", "value": "8f43d281_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863d18ea-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404165, "uuid": "ffeb6a24-d0e9-4096-a5e0-e4d082710342", "comment": "Malware payload (Dridex)", "value": "e584fd09b05b91391642c41aa6016072", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404165, "uuid": "e93bc0f5-bdd0-4655-be1c-28ec16c00b5c", "comment": "Malware payload (Dridex)", "value": "22bd6735c07b83c46c9082f726011a1cec08b9d2ea1be39ee9903597eb1deb06", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404165, "uuid": "b0e34091-100c-415b-8ac4-c0631d082949", "comment": "Malware payload (Dridex)", "value": "c1294ecd2f6aed75a58c1583e4a9adbe34a3b0c8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404165, "uuid": "26282d69-4ae1-45cf-a509-fa31f3a6056b", "comment": "Malware payload (Dridex)", "value": "e4bcdfe50b44563d572a50664adfcf19266ccdd2b35a26d3a7755ff8b75b59c7b0797cf719939373483c3e0688253f00", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404165, "uuid": "8f343981-e9d1-4983-b461-ef574d911e65", "value": "30F3D081E78ED5E0FC075B333EA80EEF52310087691854E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404165, "uuid": "02e78a0a-4f50-4902-925b-6c6b1a7cc27a", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404165, "uuid": "a9d07688-4275-4059-9820-458a2a301c63", "value": "3072:aBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjr:quXLcclWEc2HeSjNjGdeDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404165, "uuid": "28f5e7ef-0ebd-47e3-9795-49eab73ce9f6", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404165, "uuid": "e30cbfe7-c37c-4231-8358-056715e73811", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404165, "uuid": "b5535be3-8e7d-41a7-9710-ab36f7503661", "value": "e584fd09_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24680004-aed8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620352891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352891, "uuid": "7dabccf5-6d0f-42cf-a8ae-543fe9e64652", "comment": "Malware payload (IcedID)", "value": "3f14b3480c68d821fb65317a00bb3108", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352891, "uuid": "b218b234-c308-4d15-93ad-890b2e50c81d", "comment": "Malware payload (IcedID)", "value": "22e6c648df023d1d7d1af4e3b29d57ecdae804fe1bc4f0f5c35865af3236f26f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352891, "uuid": "94887b3f-e626-44fb-b1a4-6b8ad2c22787", "comment": "Malware payload (IcedID)", "value": "259b42bd399bc7da33c822ded24f2ce3843368df", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352891, "uuid": "1f7b4166-a57f-4b80-9cb7-498e5724e58a", "comment": "Malware payload (IcedID)", "value": "ee4d4838bb76312c5f12960803d21599dc046cc2d644c78e0786b7e9ed1d2e09858e5b1eebcbba211aca2eeebf7792b7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352891, "uuid": "a2066a4c-eb5d-4a4b-b4db-93860fbf6b03", "value": "9BA3125E0A5F35CD85C00EF9E2214F429BB2AC19EF05B706BB8417A278316F65BB3943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352891, "uuid": "98d28288-a644-43a6-bd12-708b975c3098", "value": "3072:6xTPjnItuBf0DHHadO7zbw1lgbRbKy4D8Y:6ZPjnouBf0u6g1aky48Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620352891, "uuid": "9a2d7092-d294-4819-a921-2f944508f684", "value": 98629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620352891, "uuid": "4bce80de-0f42-4a9f-ba74-97ecd18fd35d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352891, "uuid": "d9d5b8d5-275a-4b87-a920-c3e8f25976e3", "value": "3f14b348_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a11480cc-aefe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620369421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369421, "uuid": "f101d6f3-98bf-484d-b30e-5f10cbb9b7c4", "comment": "Malware payload (Formbook)", "value": "5600d52b0e2fe64de58ae7ac548ea908", "object_relation": "md5", "Tag": [ { "name": "4.1", "colour": "#DBF442", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369421, "uuid": "2751729a-90d1-4e3b-b2b7-9580f90104d8", "comment": "Malware payload (Formbook)", "value": "22eedf157489cb801900f963c3dd77fc047064b17965e06f7582f98cd6ad7753", "object_relation": "sha256", "Tag": [ { "name": "4.1", "colour": "#DBF442", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369421, "uuid": "e0963eb9-b1be-40e7-a733-d516e2924322", "comment": "Malware payload (Formbook)", "value": "a5b98d75bee2bbf35439f9b4bb6eb7da2ee9a447", "object_relation": "sha1", "Tag": [ { "name": "4.1", "colour": "#DBF442", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369421, "uuid": "829457a8-8caa-46bd-b975-11f29e4cae34", "comment": "Malware payload (Formbook)", "value": "a4b8d535bc5986b0b1dedc496d059ec5d4b09e252f049aee4d1092bae24aea47622520d76d419dbf26e6ed9ea3615ee5", "object_relation": "sha3-384", "Tag": [ { "name": "4.1", "colour": "#DBF442", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620369421, "uuid": "01078abc-0fea-471e-9f85-7db7ebfb6517", "value": "37242358611716C051FCBD731476485D2EF887C2E0A8EE210D8F22AC5E7618BDBFAED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620369421, "uuid": "443bd037-c0c0-4507-916e-77dede5942ab", "value": "6144:RbN35HG2/tYyb3V4dlt1xZQ/x2aFvLH00vZllj/s8:RbNp1/tYyTV4d1TaMYvLU0vPd/s8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620369421, "uuid": "60853d13-0dc6-4259-a134-2b6ed5f30a5e", "value": 222022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620369421, "uuid": "6da56a4f-493c-4ada-9a63-42835ba5d6f1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620369421, "uuid": "87b2e804-9651-4a7b-b5db-9718460a8136", "value": "NEW ORDER.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c8cc6c-af47-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620400881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400881, "uuid": "0f1bae3b-52e9-4ac4-8d8a-33076174d6a6", "comment": "Malware payload (Dridex)", "value": "909d9dbbdb69cda8a52c2ed6137e411d", "object_relation": "md5", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400881, "uuid": "97a577e3-d5f9-46bd-a728-80e7cca14aab", "comment": "Malware payload (Dridex)", "value": "22f21af5c55da4dd5cd8ab4807e7697abfe2c64382bdebbf44d1a432a91b4da5", "object_relation": "sha256", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400881, "uuid": "7d713416-fdfd-4330-9522-cc77fd00a3fc", "comment": "Malware payload (Dridex)", "value": "4b94e8cd1a2ede35e2c425426de7151e0742ccde", "object_relation": "sha1", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400881, "uuid": "d8f00802-cbe8-4cf9-ba4a-f9457545f751", "comment": "Malware payload (Dridex)", "value": "c69a311637c4040ff21bfccad80c7ad2a9096e1f3b23046567b190993dfaf506b7492bf30038e676d893fa691143680f", "object_relation": "sha3-384", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400881, "uuid": "daa763a6-327b-4c57-be3d-7156f6c215ec", "value": "AA241269C8D7F72ACBE324398AD69FA32593449291F3AC5CB909F73CE748D0364814D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400881, "uuid": "eb488e58-e141-47c5-bb03-290c9b3617e2", "value": "6144:x+PIO+/ENhLv5xyGBVeJZnC469axilrxD0:IPn+crRBjeJZ369KYrx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620400881, "uuid": "d68d15d1-17f5-4ad4-a2a8-b0fb12dcb8c7", "value": 226136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620400881, "uuid": "b841ca27-526c-4f02-aa20-6910baf0e1e4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400881, "uuid": "10a14fcd-a919-4f98-b91d-1c8bb7da657c", "value": "export of document 6600.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cef94db-af43-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620399022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399022, "uuid": "ccb327aa-d4b8-4149-beb8-e7f7a5d16e71", "comment": "Malware payload (IcedID)", "value": "f89aa09b4ecdb7196d88b48e490a3501", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399022, "uuid": "a0347bb2-6da8-47d1-93dc-5bb32ec87734", "comment": "Malware payload (IcedID)", "value": "235b4aef916cfe2b8c63778d22b79340d96bfa09354f6d755f4e78cc7149509f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399022, "uuid": "97950c3d-7441-46e9-8363-baffe814642f", "comment": "Malware payload (IcedID)", "value": "f456fa2b6682925f535c59ae5587361f59f69d08", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399022, "uuid": "7134b791-2a35-4a91-86a2-ccd1ce540574", "comment": "Malware payload (IcedID)", "value": "3b0b007d99111e9d4d23c5e58b0a3194938c0c2924950e0cd10856d13aadba5802669e5dcc32ba8cd265d8b56ba90f8e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399022, "uuid": "b5dafc55-6adf-416d-b04d-872820ab00d8", "value": "EB349226C9E8D17DF147A4B6743CDB88C554AE809E218DE7A6D6C812BF138B117227CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399022, "uuid": "f55c703d-853f-4e84-abe5-41ce9de1f9f7", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399022, "uuid": "e1bf027d-f046-48ef-a3c2-52da580fda87", "value": "3072:/Z+jEoUhhUuTjmhkJU8XV+eDOWedYlGRWMxAeiAbO+yH5wtrPPPPkeU/hLzQHaOx:HlmE9rfwZSueOI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620399022, "uuid": "fa7a9812-3b39-4afc-b44b-5da68f15d32a", "value": 244312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620399022, "uuid": "897a3c08-0920-4dc2-9420-217d3b1a2c9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399022, "uuid": "f90dee2a-fb6a-42d3-b21b-5504a68b8047", "value": "235b4aef916cfe2b8c63778d22b79340d96bfa09354f6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211a3c08-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403995, "uuid": "71334193-22c9-4e0e-b2f8-03b30f026ccf", "comment": "Malware payload (Dridex)", "value": "fdc8b15ac3f6caff1f67f6337396614e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403995, "uuid": "5f11eb90-bfaf-4fea-a116-2777219abdc3", "comment": "Malware payload (Dridex)", "value": "239a04f1e4cdaf035bf0e01502758cab7a3590635d8bd3df637bd57281f7d490", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403995, "uuid": "883d15a6-603e-45b5-9d98-651af0fba205", "comment": "Malware payload (Dridex)", "value": "9aea2047555a2bb67991001215babfbb2028a5c2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403995, "uuid": "3302290c-9c1b-4191-a27e-8f57093cff93", "comment": "Malware payload (Dridex)", "value": "5ed963b4a63b3d954c1c4f0ff2270d75385461a351d8ba80e2aaf982c782dc4e4efd0a9f1f6a87297b1426cc0f348552", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403995, "uuid": "ecce2896-a192-43a2-8bfc-357a82db0f38", "value": "31F3C141C9C5CCF0CBE36C3A4695963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403995, "uuid": "8c6eda02-d360-448b-9e47-6a248eb23d6d", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403995, "uuid": "ee9640c9-53ae-4e20-9919-caab26e85234", "value": "3072:muFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+0Hl:m0czbty9uiaJlhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403995, "uuid": "609a61f6-3090-4e15-8af6-c49e6106bbef", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403995, "uuid": "d3dfa086-7c4a-4a2d-acdd-9ee2ad71819a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403995, "uuid": "28033573-a7ed-4f31-bce9-7e9afafa3ca5", "value": "fdc8b15a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697dd78e-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407123, "uuid": "3e935e76-cf64-4471-aaf5-b87ba25b97cb", "comment": "Malware payload (Dridex)", "value": "7eba53b4b9e630cf3b5444c77e2e41d9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407123, "uuid": "b4ded144-63dd-49a2-a512-f3fd0be09f2c", "comment": "Malware payload (Dridex)", "value": "247131a88d2cfcf35a6706ac59a8a7d4ac312bc22923021e5b8a79b8c817beb7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407123, "uuid": "3b5d55a1-a7b9-40b5-8a75-c02902d4dcac", "comment": "Malware payload (Dridex)", "value": "e5c8cf46717ae9d6defb50d1505b61f04b741926", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407123, "uuid": "87b5b3e0-7c41-4c0a-8b68-dce626d9d33f", "comment": "Malware payload (Dridex)", "value": "82747b3418867fd262f82c43e902ef897e79fcc4e79041a42ef6043d34d936650b17681ee86d4964dd6a664e198dd64b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407123, "uuid": "78a8c336-cb10-4d07-a8eb-06006e1e4824", "value": "84F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407123, "uuid": "e01313fd-2d83-4067-88aa-4268171eca82", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407123, "uuid": "438b7093-7363-4473-9ebb-0d180d7430b1", "value": "3072:gBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:UuXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407123, "uuid": "93bd3363-7842-440f-86f9-6e6ef8b22f98", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407123, "uuid": "70deb57f-3bea-4dc5-a32b-fe9ed7d096b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407123, "uuid": "96b483b7-e35f-4e51-809d-3236fdf6f033", "value": "7eba53b4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77688dd8-af0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620374505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374505, "uuid": "7592924a-da96-458e-bb4a-fd7c880555dc", "comment": "Malware payload (Dridex)", "value": "d66f1e71ba13cf7c7516d42416cdadec", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374505, "uuid": "b2d210b2-b1cf-4a09-9b90-fbc946589665", "comment": "Malware payload (Dridex)", "value": "2494aae5f003ea936fdc483b2c5f989a6444a8612f54c56fcbe4b04a08721a18", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374505, "uuid": "269452c5-0072-4892-bdb7-55ddf81ec38c", "comment": "Malware payload (Dridex)", "value": "056dd86ea31196aaef1a5ef93a40eb27b2b58dbb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374505, "uuid": "7b07722b-3bd1-46c7-b9e5-4d3414132ca5", "comment": "Malware payload (Dridex)", "value": "985595cd03f3995ba24ae0f834af357d3b6f447023c49b760bfe5f5c587db5b16924154fc12b8f1ab5f136b62f03e864", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374505, "uuid": "1c92edc5-1e34-40e1-b2dc-80cdce694757", "value": "EEF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374505, "uuid": "ed0023ff-01d7-45ba-aaf3-8f5252a76677", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374505, "uuid": "a0fd0e74-ef03-469c-b8ec-33e59614c3ae", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374505, "uuid": "9cbd0c44-815f-49d9-a3c9-ede4763d6735", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374505, "uuid": "43155967-88ee-415e-b3d0-3b278d02ea9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374505, "uuid": "02da19a0-1f5e-4705-b190-d2796773e51f", "value": "d66f1e71_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80255ad9-aee0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620356481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356481, "uuid": "1b51e6df-9555-41c8-9a5a-d49edbf29193", "comment": "Malware payload (Dridex)", "value": "d63b2286b610900606b9e53b6ebf9d41", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356481, "uuid": "0caff995-d66c-4ae4-a2ba-dc4b2707fdbf", "comment": "Malware payload (Dridex)", "value": "24c0f188ba245d9f48cb6f9ffbb1811e6035e48ba0cbdf99f51dab5351c9d1f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356481, "uuid": "46e80f7e-2024-44b0-8763-adac8d405cb6", "comment": "Malware payload (Dridex)", "value": "e795e8ef4e109862c2d0746745cbeb470fef9e05", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356481, "uuid": "f9e6a5c7-490b-42b0-97c2-db35b99b10fb", "comment": "Malware payload (Dridex)", "value": "94642e5d624da6874aa60b89ec1293123ca192f544ab43e00843c956db9b4f69bcae8975f4d8186cad2fe9ddb7184c7e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356481, "uuid": "127eb0e3-4fc5-4e09-9e2a-c354528886c6", "value": "A5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356481, "uuid": "bb910dd3-a538-4b7d-96f5-876fb6f2601e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356481, "uuid": "2677ae70-e486-4256-8180-941c39cccd5d", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620356481, "uuid": "fe6db111-9ecd-4cf7-bc8b-b03934ebdbc7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620356481, "uuid": "dd853067-2179-4d53-8d66-785e53ea6e1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356481, "uuid": "db8aace2-a760-4373-84df-e896645e2ca3", "value": "d63b2286_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035736cf-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403945, "uuid": "67d4e0dc-f8fa-4905-b142-389c5436e333", "comment": "Malware payload (Dridex)", "value": "c30d1ad313d814ba8e2c399bc9dcf837", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403945, "uuid": "e357b88c-ebf2-41a7-8edd-ee3df7a609cf", "comment": "Malware payload (Dridex)", "value": "24d5b3372c928e731760f52e574a8cecf2efc1b5f2c543305727ff2e73b339ee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403945, "uuid": "47082ac3-0c49-4d5f-bd41-2932dafc5245", "comment": "Malware payload (Dridex)", "value": "9e2486237a3b9351fc239a1e0995cec204e87f80", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403945, "uuid": "39ae1a91-3071-467f-bdaf-895e5849dc0c", "comment": "Malware payload (Dridex)", "value": "4c09eab72ef6cf2949681d452ec47f8ce52bd21d851eba254ec590a66521089bc54bd66676452b4e1a1c6ed1bccd7441", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403945, "uuid": "4b165f4c-9cf3-4c10-bfb1-7f54f806245f", "value": "78F3D141C9C5CCE0CBF36C3A4795963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403945, "uuid": "a035e851-0209-4184-9e4e-144ffda2e653", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403945, "uuid": "be79018e-6cae-4075-8c45-6d033e98fb2a", "value": "3072:/uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+zG:/0czbty9uiaJlyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403945, "uuid": "4fccfda0-6e35-4467-b255-9b1cfebd16d1", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403945, "uuid": "221238e1-6595-44f5-b745-a2d2bd36a6f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403945, "uuid": "3fae7765-addd-4088-91fd-c5cf698c6e6c", "value": "c30d1ad3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b2b866-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620392514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392514, "uuid": "2a5cc2dd-8a84-4b48-bcc2-c3789a87fa4d", "comment": "Malware payload (Dridex)", "value": "f5d0d89809e99a2af5caee55a2720aef", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392514, "uuid": "c1114a13-99ed-43e2-a3c5-bc905e3e859c", "comment": "Malware payload (Dridex)", "value": "2507c1bcb039cf1a4f420d83ea97137ae1d325ed487bf8b5b3bb543c076b4950", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392514, "uuid": "5289defb-7549-40bd-b4f0-7dfa8c1ca029", "comment": "Malware payload (Dridex)", "value": "3c10dad606efed0287b19472c1a8a3f2e1d3c4a1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392514, "uuid": "7d50e68c-22bd-4f0c-846e-e37d66535434", "comment": "Malware payload (Dridex)", "value": "b74d785dd413e426fa869eef7d0262fbec119220aa69c6041f7f8186fefd45d3029051b26e1d2dd5814482a124b0fe0d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392514, "uuid": "073c22b4-b9d3-442c-bb39-365c92d667f8", "value": "EDF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392514, "uuid": "1b9f3711-4e1d-4e24-8ddd-57b3247a7089", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392514, "uuid": "72624747-77fe-413e-86c5-de827584e033", "value": "3072:cA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:c3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392514, "uuid": "4f58b370-7b15-42f1-8210-6d40eb9438b0", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392514, "uuid": "5fa2b08a-cb4d-4aa8-82e7-c0b9dcecc763", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392514, "uuid": "bc152508-2d1c-477e-b375-42a857934a34", "value": "f5d0d898_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ace466f-af12-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620377866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377866, "uuid": "26624bdb-aa19-4018-8cde-4bbf4d9dd91e", "comment": "Malware payload (IcedID)", "value": "8dcba9f16d2602c09ccc7bba8463357a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA551_Shathak", "colour": "#65AF79", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377866, "uuid": "ef8a4b87-0fc0-4897-8366-e31e457bb22f", "comment": "Malware payload (IcedID)", "value": "25368ee6e7d6c2f666080dcc0ec72dab4fb3c5d4756e41d7533d54611df5a485", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA551_Shathak", "colour": "#65AF79", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377866, "uuid": "3b864938-12b0-4ee8-9d19-388501552553", "comment": "Malware payload (IcedID)", "value": "e10dd38a0e372a1f5cd100e36926227ad54613ae", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA551_Shathak", "colour": "#65AF79", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377866, "uuid": "4196c044-e645-4b71-82d3-914be136c6d5", "comment": "Malware payload (IcedID)", "value": "83393dbc6547207b1aaa5951a1c4f13af9db314ef4547e445f5c933c533f3a7263dcceb3fb144919541a4a92c0a0bb1b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA551_Shathak", "colour": "#65AF79", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377866, "uuid": "84e5cf33-aec9-4f11-9901-1f61d255055f", "value": "4B8337219B699B80DCC678775248CAB1D3314FD0574377EBFEACBB0D2B68981482526F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377866, "uuid": "139ad5b0-7c29-4f7b-9d4d-f768b95cebbb", "value": "1536:alrlJAP0w2W1bTDkNnhipFnY5IE2vYjsRBs:QEP0w2C3DMInY54vYjsRBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620377866, "uuid": "3c460dec-c75b-4f9c-a0f3-0dece9ba7a07", "value": 81228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620377866, "uuid": "d0080399-f5ab-422a-843a-e27b55ed9185", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377866, "uuid": "5ec30bd2-be2f-4caa-bbde-c65f56a9ad15", "value": "specifics-05.06.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a2188f-af6e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620417671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417671, "uuid": "c9289e86-656d-44bd-a0bb-12cec50edbfb", "comment": "Malware payload (Dridex)", "value": "b208203368271136808698d77addab63", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417671, "uuid": "e1f7a376-6af4-4c77-8958-4a813192090a", "comment": "Malware payload (Dridex)", "value": "25382e1bf5f56ec15c6f79031c7e47c2606f31ed62b1ad4d0f607ca3ce237120", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417671, "uuid": "237808d0-526a-4bf3-b6d2-b8fddd288299", "comment": "Malware payload (Dridex)", "value": "521ee434123e68ec22b04cbe77ddfb4f4258cc47", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417671, "uuid": "fa4d95cb-9db8-46e0-a8c1-ffd7c5532422", "comment": "Malware payload (Dridex)", "value": "1ade59b6f4cce320f35a83ae6db5d09ed89ae187c9927e5f89a4785d6f5c32614e43a0c18162296f8e912516b871381e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417671, "uuid": "71fa990a-2c63-464d-85cf-d158272c2849", "value": "DAF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417671, "uuid": "804d0073-6839-446c-a026-fe45de3f244f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417671, "uuid": "98ccf206-6dc6-49ff-890d-6d36571e1341", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620417671, "uuid": "85b6339c-fa73-434c-9940-efc88001a993", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620417671, "uuid": "79437474-0845-428a-a097-f86b43540315", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417671, "uuid": "cd9cc1d4-2286-42ba-be3d-8791d508256c", "value": "b2082033_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad7a0e0-af7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620424896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424896, "uuid": "5ef251ba-d7c7-4e52-a0aa-4d4ea3a82f57", "comment": "Malware payload (Dridex)", "value": "76b44d4de21eb8f97d1642ccba6c31ff", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424896, "uuid": "d42b1aff-ba0d-4bf7-bdd7-ce27ea9814f4", "comment": "Malware payload (Dridex)", "value": "2561bf2261de49e732995b4869a3a7a66041f92e284ee6668bd2db30f3d60209", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424896, "uuid": "2fdf56ad-f3c4-4ac0-9452-7af90c498144", "comment": "Malware payload (Dridex)", "value": "826d92aabbae074a918ce504eb4eb60265cb738d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424896, "uuid": "9a50e47e-681a-4c28-afd6-ff7775be4026", "comment": "Malware payload (Dridex)", "value": "6d4ea053563e9c06a921106b435d8afbc3b061bb8f6ae1e360d11e6581d9bb69ffdf20649d501041d6495b5a151e005d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424896, "uuid": "de2c5455-8e3b-4d06-ae7f-d3679ea5fc3d", "value": "9DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424896, "uuid": "81513fbb-bd8d-468d-9a33-8cde0a040127", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424896, "uuid": "25bcd8b4-dd5e-439d-b720-391f8a45d36d", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620424896, "uuid": "b7c20b60-b5c5-4994-8957-2c014652ec14", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620424896, "uuid": "92dd18dc-aaf5-44b3-90e1-6f0eb0b08eba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424896, "uuid": "915d93b2-c02c-4a51-9c2b-5c8d295743d6", "value": "76b44d4d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ba928b-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407137, "uuid": "4d4b430c-e70d-4223-af5b-b44a9491fde8", "comment": "Malware payload (Dridex)", "value": "bd55ebdd6816db6baa48949b994c602b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407137, "uuid": "e3b3aa9e-a403-4cbc-ae41-e27dbdb6278f", "comment": "Malware payload (Dridex)", "value": "25b8e401e0600de33c28e7024a13e675653ee4ad368e001fca3a208995f98cef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407137, "uuid": "a4386631-cc11-4035-bfec-c7802ea43f4e", "comment": "Malware payload (Dridex)", "value": "2e8fe4be8a37b2a996295b1cc9909f2470c834d9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407137, "uuid": "3de8aedc-d054-4517-92d4-0a6dea7d8b9b", "comment": "Malware payload (Dridex)", "value": "acdee2deeddaef7bdd6e49c9493be7639d1fc310e08507b591338ed9b2a84951e2cbc5b31e30384d884491e31def8101", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407137, "uuid": "3592ae5d-f34a-4a87-8d36-e8ec3cb414ae", "value": "A7F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407137, "uuid": "2a053f7d-b77a-4fda-849e-80e92a45273a", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407137, "uuid": "933a6aff-e48a-4844-9c65-471f21d6b0f4", "value": "3072:MBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:4uXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407137, "uuid": "63b474b8-e742-4fa5-ac27-da282d28d6ca", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407137, "uuid": "3b909284-1c80-43ec-8647-9e10317df584", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407137, "uuid": "2f8b8d7a-469b-4c12-b316-07c7d8181d33", "value": "bd55ebdd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f9fff2-af5e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620410479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410479, "uuid": "8319a872-0aba-46a5-9fb7-40b21a632f35", "comment": "Malware payload (Dridex)", "value": "8c7911464dbd1c34cebc05e50b974339", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410479, "uuid": "67cb9ce7-e632-4b4b-80af-425295626a00", "comment": "Malware payload (Dridex)", "value": "25d3cea176312fbfcb6cb5a9875220eac27461f4c2abdc0f8e2bf705e3f14736", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410479, "uuid": "69819597-7ee3-4ca5-9c30-7b488d08db9c", "comment": "Malware payload (Dridex)", "value": "c5e58732517af8fbedb5588cee9882a1d8c242d4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410479, "uuid": "3d6ed8d9-7f82-4b44-803a-6a4ee8f24956", "comment": "Malware payload (Dridex)", "value": "5c3fe79df254703c47d3449ee4ee183d3405e2b408f02b99c15730e76a9195f4e2ca09da1ce383cb4edb7497be680e24", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410479, "uuid": "909295a1-8e1e-4923-82f3-1da3be8a761a", "value": "6EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410479, "uuid": "4295aa34-5d96-45e0-81db-6001079f1303", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410479, "uuid": "8a57e0ad-dd50-44ba-8903-1eee614bf108", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620410479, "uuid": "d37e727d-fe74-44b5-b432-74cc895d446d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620410479, "uuid": "a01eb45b-208b-4df0-bb37-a61e6b5870da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410479, "uuid": "d6a00786-6c80-4ad9-a5c7-c7a0f8f28630", "value": "8c791146_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416ba2e9-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407056, "uuid": "399df327-82f8-4161-978f-c2f88442d965", "comment": "Malware payload (Dridex)", "value": "336aa7ce34a50a450dd89573ea0cdd83", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407056, "uuid": "f1ab699a-9e20-4b58-a41d-413234f0ea2d", "comment": "Malware payload (Dridex)", "value": "25e572cb969cdfc9718b0e3a6be5c565f3b7460b4e170f2648eec4c8aa4d1219", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407056, "uuid": "92e0d240-d0da-4767-aaba-54587286c9b4", "comment": "Malware payload (Dridex)", "value": "310556c341a4e84b4080c0ff9127918c4ef49ff6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407056, "uuid": "7cca8636-68b7-4db7-a5d2-fddbb4c4bede", "comment": "Malware payload (Dridex)", "value": "f5d5dbf6fe43f75dc734a30b25e7ded06191382343dc43fd5ecfc0a9e468a47fbb7eb505afa2419ee49b3db293fd294a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407056, "uuid": "2bd3d866-71ef-4072-8844-680143ebac56", "value": "BDF3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407056, "uuid": "74764293-89c2-41cd-972c-98c5d9550001", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407056, "uuid": "ee7a749e-706f-43a3-9769-3030d1fd3bf5", "value": "3072:XBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:RuXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407056, "uuid": "04f0f017-7492-42f8-9281-b9b67e1b9541", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407056, "uuid": "b87cf3ae-5ddf-4e0b-bc13-c648fbcd319f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407056, "uuid": "afa9b8ea-318a-4945-a074-8e308952882e", "value": "336aa7ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df464180-aecf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620349339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349339, "uuid": "dd135236-98bb-4b45-86df-a46a87bed797", "comment": "Malware payload (Dridex)", "value": "85bb7abd80cb055d846032955590b288", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349339, "uuid": "0e0fb667-14ff-4c87-8e04-c98b7cefd5e6", "comment": "Malware payload (Dridex)", "value": "26072f2b14fb5d103fb8d98dc1f68951ac007cee5245b7b2d6501fe287f73a41", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349339, "uuid": "570fb3ea-caba-4c66-978b-60f9c35176d5", "comment": "Malware payload (Dridex)", "value": "37929f7338a3aef758f30da6a4ed180c4522fbcd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349339, "uuid": "92f8634f-2fda-49ed-a109-cdba2acbb402", "comment": "Malware payload (Dridex)", "value": "d18546c8299b453b0245fb2e71bd88caa7d72a44d4a192ce065d7a6be560a165ccbbca9a43f0251e7450cf137f0ee10c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349339, "uuid": "1854bf87-ca87-42ca-abbb-4f6cfbdaef1c", "value": "F0F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349339, "uuid": "29a5aa05-2af9-43e7-b0d7-8e23db4e3bae", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349339, "uuid": "404a94d9-b923-4b63-869c-411387832909", "value": "3072:9lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:9lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620349339, "uuid": "db6c1f64-fba3-4a10-ae2e-eb3c284e0286", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620349339, "uuid": "c3fe5e8e-ca56-40ef-b542-b240559ed0cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349339, "uuid": "103497f3-669e-424a-b28a-55d101946385", "value": "85bb7abd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a94d350-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404011, "uuid": "4388283f-31da-4a7c-9218-5b186b3bed5c", "comment": "Malware payload (Dridex)", "value": "e6f0c56efd9be26cb54fe67413cb044b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404011, "uuid": "33542783-9813-4052-93a3-97e80229d4f2", "comment": "Malware payload (Dridex)", "value": "260a713b471312a7ecbd813d8e2edb34992e01c1b18ea87603a5e8f4fa2ebfde", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404011, "uuid": "d1509041-c267-418c-b483-c6aacebeb156", "comment": "Malware payload (Dridex)", "value": "01eb2e520a70e274148c0767d9324ae1037a9e50", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404011, "uuid": "61289843-fb62-4d85-84fa-a1e06cb515cd", "comment": "Malware payload (Dridex)", "value": "a4634a49bfc65411ada8adcc6ea83c76cdab1f13ab1bc45855e460ba2aeecde7b79ed08a614de4b621d83bb3c5c924ab", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404011, "uuid": "4f042b88-729b-462f-9d64-206c6cd92376", "value": "80F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD5BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404011, "uuid": "1f111fd2-70fc-4268-83b9-cc5cdd062e56", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404011, "uuid": "741c1cd2-7007-4dc6-bc3f-ede78873f06e", "value": "3072:tBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHOF:DuXLcclWEc2HeSjNjGdeuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404011, "uuid": "db0c292f-85ee-4304-85e6-a092620b54fd", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404011, "uuid": "9c129403-ae91-4974-8cb1-ef35d794ad39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404011, "uuid": "c5cf367f-0e77-48bb-8f93-c089e034d5e2", "value": "e6f0c56e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8db811-aef1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620363719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363719, "uuid": "8c5be8bf-7c1f-45ea-9eb2-7e4ea6360fb4", "comment": "Malware payload (Dridex)", "value": "c46a0981788a580ba9ceb875c3ead9ed", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363719, "uuid": "3318ede4-1f5e-4011-8c18-7231a17d98bd", "comment": "Malware payload (Dridex)", "value": "2622002fbcb48524ce32fc96e0a33855ac8acba72ab22faded84d89554047f72", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363719, "uuid": "7d657992-0780-4da0-bfe6-b7fc5efef3d7", "comment": "Malware payload (Dridex)", "value": "8e0e35df9ecce11eda7cf7202fbfaf1c374d25ef", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363719, "uuid": "365fb51f-f20c-4253-a87a-a22bb02c9212", "comment": "Malware payload (Dridex)", "value": "47ab6bee726baa61f437115b95031dc208dc7ba9d0803e4b977a687ebc61eb5a1224a1fa78d1903118163949f6d9c38e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363719, "uuid": "328b8aea-cdd6-4824-9393-9813a0a5de90", "value": "68F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363719, "uuid": "c331d755-beab-40a6-b49a-c7b6f7e13f09", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363719, "uuid": "85ff02e5-433a-4b52-8d7b-a8ca0cd741e3", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620363719, "uuid": "3d55dd25-c635-46b5-b2fc-8c3ef7de8240", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620363719, "uuid": "34eb41fb-43c4-4602-b237-dfb8a7904fea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363719, "uuid": "a441a3a3-a4f3-4b43-9fbd-c962e2cc2218", "value": "c46a0981_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b386be32-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403811, "uuid": "f0a73bcd-513e-403f-830a-2a87e9996184", "comment": "Malware payload (Dridex)", "value": "7245663707cd92759e108a82639770d8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403811, "uuid": "f85c4cb8-a99e-426c-b036-d111835b312c", "comment": "Malware payload (Dridex)", "value": "262ac6ea68786ddbf6a2c4115d117c4f8ba62c6cba7b741fbb84049ee339eef8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403811, "uuid": "6ed24435-f1f9-42e9-a3dd-59ad11565265", "comment": "Malware payload (Dridex)", "value": "0b3ef21479c63df13ace711fed1c2817693d8495", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403811, "uuid": "95ceba94-9ca4-4244-a6c5-3a36ddab72c7", "comment": "Malware payload (Dridex)", "value": "2af23361b4f52080e8bc58d449494de08b7080d276b39e852e8e11a472e0611aa02f79a454f975f4d027aae663408b4f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403811, "uuid": "ab1807b2-ad29-4d8e-8c03-f7f89c88a56c", "value": "4AF3D081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403811, "uuid": "c6558edc-ea9e-4dcd-867e-c959b3d7cd0c", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403811, "uuid": "b7644b2f-4943-4f98-9eff-dfd3fe71d80c", "value": "3072:ABoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHcY:0uXLcclWEc2HeSjNjGde8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403811, "uuid": "486408eb-2c3c-47fe-9f5d-3caa06bc78ee", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403811, "uuid": "79e3ab0f-0beb-4b2a-9daf-22558243a884", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403811, "uuid": "dc1f152b-84b3-4eee-956a-82e14aabe733", "value": "72456637_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd99bfa-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407456, "uuid": "aba8086c-1851-4d69-9f26-3e16da04b1fa", "comment": "Malware payload (Dridex)", "value": "7a8116e1113a31d0088e8656a63e8a6e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407456, "uuid": "2d1f1cc5-2fc7-47d7-be14-bf5fc64df761", "comment": "Malware payload (Dridex)", "value": "267e888ef4e733ce8ce75b3b688fa39fbd836d6b14eaf3587b165df28007fe07", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407456, "uuid": "cc048fbd-09ec-4906-93f1-e957d98d5a6a", "comment": "Malware payload (Dridex)", "value": "72c54a3406b583857899b8e1d76d624a8bfa97a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407456, "uuid": "355148f4-807b-435d-9f02-2607700a5630", "comment": "Malware payload (Dridex)", "value": "41957d0007dbf067382e964104626b0031316235faed3c5f2205334c792c5b87e3da4c4464d503436229e190217ca04c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407456, "uuid": "221aef4a-6609-40ea-a447-659bae11622a", "value": "2AF3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407456, "uuid": "cf6f671c-cf69-417d-aa04-abce2b472006", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407456, "uuid": "611afca6-06e0-465b-a920-05441e86497e", "value": "3072:WBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjf:uuXLcclWEc2HeSjNjGdeDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407456, "uuid": "c7c0dfa5-3f86-44c7-818d-38164023c475", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407456, "uuid": "f83ce293-3943-4193-8afc-59abacd257aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407456, "uuid": "79d059be-bc8b-482f-97a3-626a539030da", "value": "7a8116e1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5814c78-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407251, "uuid": "a560fb4a-fad5-4faf-8cd2-4fc3784dcee9", "comment": "Malware payload (Dridex)", "value": "ae5acdb39d75410056e6cbd1676f6ee7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407251, "uuid": "b2470786-2527-4be4-9219-7a563e7897d4", "comment": "Malware payload (Dridex)", "value": "27245cba568f9399de6c0b387cf6b6e8532bc21820af36353e8c8642dc8f0db9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407251, "uuid": "7e422105-a7d8-478c-a98c-fd5030ea2cfc", "comment": "Malware payload (Dridex)", "value": "5a32b0d6e88565f198e569c01fc8428f54d53049", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407251, "uuid": "4378161a-8598-4a1b-8aa3-0265d53cbe87", "comment": "Malware payload (Dridex)", "value": "3968143f9cda4c2a49eaa4ee30072413758f0d2f912f85466f40ae77fe6b86a0e383ccac785d5eb6be115b4f397f74b4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407251, "uuid": "2af16ce9-383d-4e38-8b3c-940b1b211a89", "value": "E6F3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD5BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407251, "uuid": "e81fd0dc-db5d-4e68-9fe5-899efec42904", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407251, "uuid": "9d9d76ff-768e-4b85-8f39-d5ab0a2bf33f", "value": "3072:gBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHSa:UuXLcclWEc2HeSjNjGdeya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407251, "uuid": "89a5325f-57c9-4268-8ce0-90f4a21704a6", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407251, "uuid": "8986c9f8-539f-4947-98be-03327e51b042", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407251, "uuid": "a62428ca-36d2-4186-99da-5446d3bcc185", "value": "ae5acdb3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1930ca8-aeef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Nymaim)", "timestamp": 1620363086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363086, "uuid": "0794daf5-7aad-4305-a567-882dafd50ab8", "comment": "Malware payload (Nymaim)", "value": "225772b6019e65659f9bdab1fff7dc15", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363086, "uuid": "ab88999d-ea8f-4281-abf2-04ddffd91dcd", "comment": "Malware payload (Nymaim)", "value": "2754f8dc0a1e12ce3be4e3fa6719f515105ed82d2f23d3e5c1215c36e1b108ea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363086, "uuid": "277b31bc-6776-4e83-8562-6f8a61191b0c", "comment": "Malware payload (Nymaim)", "value": "983a1ca200e74a5a173cad4d5303a1e6220edf96", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363086, "uuid": "bdd27e3b-026f-4cad-8b36-d42eace2b239", "comment": "Malware payload (Nymaim)", "value": "9a56726a3cc33a05a0c08d8f08333a907d6ab04ad00425c59b5d5bee0a937d706e563f62470711c025e4be7cb0bc4cf4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363086, "uuid": "19251d44-676d-48ef-8285-528280f11bf1", "value": "9FE4126B98AB4196F8B07736C06F3B7ADB70C720C2517C78D3D909DAAEA34CA43155B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363086, "uuid": "246dbf90-cba7-4dfc-8fee-a15a7e901d40", "value": "dab4252e8e394787570ae1bcd8938c61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363086, "uuid": "13495167-5d53-4b04-bd4c-66f949542694", "value": "12288:VqDkjwcpbNB89YmRt4e5F9tVI6W6JLS3mw97+rq1Kf2:Llb9e5Pw6W6JLS2w5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620363086, "uuid": "fe652655-d515-42d3-aa39-7a387246139f", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620363086, "uuid": "178fa788-bb6c-472d-a801-bbb268a30206", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363086, "uuid": "f1f9ff69-4097-42f9-90f5-0125046a7ace", "value": "Verrechnung-33352265587028K0.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd72efaf-af36-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620393520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393520, "uuid": "809eeb46-c3a2-4763-b790-93e5d4f1190e", "comment": "Malware payload (Mirai)", "value": "3e773370a45da15df1a1e7888a40f81f", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393520, "uuid": "79a0db3e-e237-4b57-9b36-9a0744ab3f55", "comment": "Malware payload (Mirai)", "value": "27802001c9df792dc8e5741565d78188afbefc286076681dbdf6386863c7355c", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393520, "uuid": "99fbb36e-d69f-438c-b546-1d595ea53ada", "comment": "Malware payload (Mirai)", "value": "c2f48676e2609d091a44d9e4f62993dd9f7601be", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393520, "uuid": "8a8ade2c-697e-45fe-821c-59f5853767b5", "comment": "Malware payload (Mirai)", "value": "0799a192544cf7a16a9a199dbf09fe1ce2ced94529d42211a5eeb29d3b54fcb41edf5f74679d72e0cccf5f7a1ceecdcd", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393520, "uuid": "225db805-39db-400a-bebc-60a322bae6b4", "value": "9863965D2E219FACFFA886344BB35E20924C33E626E1C945E15DEA011E7034E745FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393520, "uuid": "545cdbbc-9849-450b-aba1-a2535b2597ed", "value": "1536:58B83DOpSxUzpP+vntvnCEvnNY8pYdMN+SyrQEDLqTeJqmS:qK3DUSq5s8SyrQEvqTeJbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393520, "uuid": "652ffeb3-00da-463a-acf3-43b5f8a385c5", "value": 67564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393520, "uuid": "fe9a4b1e-f61c-42ca-8201-1f63be55618e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393520, "uuid": "3e29f4ec-6329-4b93-912d-15e501aa6438", "value": "badpackets.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8d69be-af7f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620424870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424870, "uuid": "fd573734-9f9e-4fdb-a2fa-48e595b9ef1b", "comment": "Malware payload", "value": "a0ec6a56c73c187329056fc52973e9ae", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424870, "uuid": "974637d7-5bdd-40f1-bf30-f00046126ff4", "comment": "Malware payload", "value": "27ab5a1a19244f573258205d7f40e9895b2b5a2a5d231e0ba8d3c50d63c253a5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424870, "uuid": "5fff4c85-4625-4f09-907d-c1aa153ed050", "comment": "Malware payload", "value": "951c44b931d02bb1b2118c871f0b2f1337961653", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424870, "uuid": "12eaf5f8-f7ed-4e04-a143-64323e510d5b", "comment": "Malware payload", "value": "66f3bbfe75a769e90f0f1610629e0bea2cc083884e4a9300ed9b97b12a23f36ee53303225c1f8485f7581c80e3f2c534", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424870, "uuid": "bc828013-06c9-40f7-8a01-a952304a2139", "value": "81F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424870, "uuid": "13dabe73-4049-48ab-8d59-04a62c775485", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424870, "uuid": "8b1ead88-f9dc-4550-b0d6-ec36b7ae8bf7", "value": "3072:hiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:yeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620424870, "uuid": "a2e3cff5-4e9f-4e11-ae43-c62e6c7397e0", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620424870, "uuid": "82f67742-83ac-438f-afda-77de78bbd3f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424870, "uuid": "ed79edcc-b91c-4a88-ab39-ca5486bf1638", "value": "a0ec6a56_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f87d4f8-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404181, "uuid": "3fc3471d-c89e-4dac-8d4f-7e474628f1e6", "comment": "Malware payload (Dridex)", "value": "5c6ae9623ca560c43174ad104448e768", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404181, "uuid": "21f411b1-92f4-4107-bf97-9bb2c7660a37", "comment": "Malware payload (Dridex)", "value": "27ea9415efcaf02fbcbcf036f6b8e53f77d04c4624104796800b6e3eb3669f61", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404181, "uuid": "39aa1900-fa37-43f5-a8d6-f84599087d47", "comment": "Malware payload (Dridex)", "value": "295f086d50d56848590436db9632298fa1da8651", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404181, "uuid": "fa60433e-5632-4749-abfc-18480ab1ef98", "comment": "Malware payload (Dridex)", "value": "85a44e3c984244af32fc6f869951902622f7f47c3bafd811bc4d511f4f13d432248ff4cb506153620e9a69c69173ab8d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404181, "uuid": "a534c1b8-0e64-4274-bc51-575e49c29b50", "value": "56F3D081E78ED5E0FC075B333EA80EEF52310087691854E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404181, "uuid": "6dc572ce-5eb4-4b10-aa4c-d5d9345a2c7a", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404181, "uuid": "7e44d7aa-353e-423a-b7ee-4dfd40bdb85f", "value": "3072:2BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjr:OuXLcclWEc2HeSjNjGdeDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404181, "uuid": "631c3dca-f9d5-4f8d-8cda-49839f77b743", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404181, "uuid": "ed57aed1-1a2e-406a-94c2-3dcbf43ea9a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404181, "uuid": "49146fc6-87cd-4e13-8edf-578aa817d606", "value": "5c6ae962_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d93db6-af02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620370929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370929, "uuid": "3b2e0167-cf75-4f39-8dfb-d4fc2034d7ef", "comment": "Malware payload (Dridex)", "value": "05686382a70017cf0aa60e41f0ef4d52", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370929, "uuid": "7fb25d98-82e3-4168-ae12-bee8f4baf7e2", "comment": "Malware payload (Dridex)", "value": "282c5d0a52b89a02906c9f1ec2c809ebbe9a2007cca81a1b38af1f43b694ffdf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370929, "uuid": "7eb8be13-33fc-45d9-b983-84659cd21315", "comment": "Malware payload (Dridex)", "value": "e43fc8f4f5c144db18ad188be6b27c4af007fc40", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370929, "uuid": "5ab9db35-a543-44da-b3d2-b3effc8757f4", "comment": "Malware payload (Dridex)", "value": "e9eab740784f276af64eaf33ed6cb46f2647cd4e43d5f0455546baf8a6064b3b29dfd7eec3b1ca4631895891d2e42ed4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370929, "uuid": "9d23a639-1768-4c9d-bfb1-cdde3ec0c9b0", "value": "71F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370929, "uuid": "4cb5a976-b2b7-4c77-ae0f-f16d8398cd1a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370929, "uuid": "f9fec828-a9bc-4d6c-a90b-31d1e92cf43e", "value": "3072:9lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:9lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620370929, "uuid": "8c40db3f-ae55-4db9-a3a6-8c5fd5255108", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620370929, "uuid": "8ef43ce2-b6c1-4ca6-a3a3-7e7c84ceebce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370929, "uuid": "b63066d3-96c4-4960-86c8-7684633b0bfa", "value": "05686382_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b58efa-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620392695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392695, "uuid": "1e165170-7c07-4286-bfea-a9903ea3430c", "comment": "Malware payload (AgentTesla)", "value": "e57c45cce1585bcd57813bea5208b31d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392695, "uuid": "28e74497-fed0-4084-a22a-da230cfbe983", "comment": "Malware payload (AgentTesla)", "value": "28df700cb8f6a7100d2cb20fcb51cd53dad822386d51701dbfbda945c4d2bd05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392695, "uuid": "c641905f-cb6d-4a45-b2f3-a8061c6d0e67", "comment": "Malware payload (AgentTesla)", "value": "9eceb3f1d761d2af6b3ae9395a57152743848e2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392695, "uuid": "9924a9d0-ae23-44fd-aff8-11a071f80618", "comment": "Malware payload (AgentTesla)", "value": "45fe6450b686279ab5340ae424c144756f030db26d42a8614020f151e08ab6888779029d9d0ff7a57f2cfb0a15e59cbd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392695, "uuid": "12a71299-cbea-446a-aea7-1430607b8878", "value": "8105F0AA2700CE63C6295572E1A173F052F2AD01F2A2EE4BBDC13DAD79B2EC157541C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392695, "uuid": "0dc3bdfe-eedf-44f0-acc8-74948185226b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392695, "uuid": "e69b8d05-bf87-4ba3-bb54-7d2ed5d42f6d", "value": "24576:l2RG1loh1rCLmiQ3EsT82CYdByfuwfeGs:GKoDr0RQ3Es1WYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392695, "uuid": "b357ebdd-b011-4335-bca1-885b6e949181", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392695, "uuid": "3b75eeaf-7d20-46ca-951b-530bf57ae792", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392695, "uuid": "bb565aee-6f70-47a1-acb9-82c2d070e864", "value": "SCAN_COPY_00937782.PDF_82KB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1cb3ee-af35-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620393031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393031, "uuid": "af866290-c4e2-40d4-b6b7-770ee867f7af", "comment": "Malware payload", "value": "a0b3a3d06df8fe3056f237fc3f9cb495", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393031, "uuid": "7f35bb9d-f20a-4097-a122-74034f519ed5", "comment": "Malware payload", "value": "298a0c36e68bdacb4c368b0b8b5add152e991423ee0a07bd771083e1def82a3c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393031, "uuid": "d03143d4-e340-4615-80a2-51d16d872e5d", "comment": "Malware payload", "value": "a01a4f4b997fb724a1fe648447a1b2de36ec6c73", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393031, "uuid": "edec1b39-0954-4134-a91d-5c697315650d", "comment": "Malware payload", "value": "fefbc4d7f07d8da5455170453174e97dea417675d18a057ef2c5328f4ca99c98d65fdbedf11c998a110078f50d202315", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393031, "uuid": "fffe164e-4dbd-444b-b5aa-c7c3f8378bd6", "value": "C6433A0037988F47C5A65DF9283F23D583FEEE9025B8F1882A0FD60A4275E33555BE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393031, "uuid": "0b83c6db-6334-4c33-a3b0-b573b1dbecd9", "value": "768:V8SKgDwmzCAF9oRcbNWV0nyGdGWgQ+wJ9RbL175Eo3NTHENgErynpvLq0f3eyXrv:gVGwvV0nSEnaIpM0p3eyXm+A2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393031, "uuid": "964e3407-666c-4af6-b969-3318148415b3", "value": 60640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393031, "uuid": "caccdeca-f470-404b-8e0b-2e336f179168", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393031, "uuid": "f3675188-163b-490a-b0fb-695b4c80f4ed", "value": "94VG.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ec1e62-af1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620381753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381753, "uuid": "7107a76b-7b03-4e97-b87e-fdddd7f45f49", "comment": "Malware payload (Gozi)", "value": "8523b35346a32d79d346bb04b165bdeb", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381753, "uuid": "8b258de1-af47-406f-98f4-9a535f5fac7c", "comment": "Malware payload (Gozi)", "value": "2abfaa527968640be3f638058923fb6714e9935d55b423450b970cc38ec5fb6b", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381753, "uuid": "5a00ac00-1c55-4ecb-86d3-3425cd5e8057", "comment": "Malware payload (Gozi)", "value": "d0bc590bf68d8d753caa2e8d3f3d4c092dbb8e14", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381753, "uuid": "6ca6b345-ce9c-45ad-a1c1-c8b03e4f3cfa", "comment": "Malware payload (Gozi)", "value": "21c4a19f2b6053e9dae6f803d07d8daa7a5fe889bd53e58a8b9d91b4cdcd7d0c1d0d49909513c519fff107a30fbbd520", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381753, "uuid": "6bed223d-168d-4898-a687-5fdfb4bd5a9f", "value": "80F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381753, "uuid": "8682cfbc-3f6c-45ab-9a21-ed91a83b1239", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381753, "uuid": "d3f96ecb-4239-4036-b251-dcca1507f7f5", "value": "3072:nIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Ic7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381753, "uuid": "6a8bc9fa-c5ef-415d-98a0-9fb9a14337ac", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381753, "uuid": "6b27f602-e0da-4322-b7d8-19c13828e163", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381753, "uuid": "074aa45d-9874-4dce-8641-318ae3715432", "value": "8523b353_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5744ff1-af0b-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620375038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620375038, "uuid": "7e652f6c-204a-49dc-9aff-aa22941d970a", "comment": "Malware payload (ArkeiStealer)", "value": "c21c38b41e26d025c1772834ddef86f0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620375038, "uuid": "e3f11a4b-2cc9-4154-acbd-5badd818682a", "comment": "Malware payload (ArkeiStealer)", "value": "2ac370f6d3f2a5f8008415fb9e0a20b676d08ef337e81722499c96ba47d8a8a1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620375038, "uuid": "e4ad4b7f-fdf3-47bb-ae23-c8da3a10d465", "comment": "Malware payload (ArkeiStealer)", "value": "32898d4cef9a5ed56ee3b0974ed4140290f39903", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620375038, "uuid": "a7d0b697-6600-4c71-93d2-8b658ca85644", "comment": "Malware payload (ArkeiStealer)", "value": "c7fddcd83a142ff320e1f08b2d8d5dba0146f33fe14d55e5aaa8f74682e462d04673c97f041530b0beafe7ef25b77f14", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620375038, "uuid": "48616438-e750-4d69-9149-2d4c381a50fd", "value": "DBE4D030BAB0C437E1A712F845B682BD75287EA19B2460CF52E43BDA56345E5BC31E4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620375038, "uuid": "2d31b5f8-01b5-4a7a-bb3f-8a004dbe483e", "value": "cc70c4d3d05841a7e1c0cf04c321ea38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620375038, "uuid": "2b4e9b3c-dec0-4012-84dd-a3eb466225fc", "value": "12288:v1nGX2rhZVcrF01D6YDy46PEYVHk28A41OtdQRHsKgrJBTP:YGrhj6YDWEY1MA41OCHsKgfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620375038, "uuid": "ceff84c5-162b-43ef-8dac-d8db86343a34", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620375038, "uuid": "4d33c2f4-52f1-4426-9477-e8448eb76308", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620375038, "uuid": "496b4585-f1b8-404e-913b-2c6c511ca341", "value": "c21c38b41e26d025c1772834ddef86f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca835d5-af5e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620410484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410484, "uuid": "884e540b-efe4-4db2-ba1d-190da65c2c19", "comment": "Malware payload (AgentTesla)", "value": "1a01b6585e0fbcb0ad10886f94ca5290", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410484, "uuid": "23607a81-780a-4274-89cb-fb084bbc294b", "comment": "Malware payload (AgentTesla)", "value": "2ade71fb5ddae5ce5ca9d6d578d4229062999c5aa28575f0912d96ff1c629a43", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410484, "uuid": "b9de1196-cd6c-42fd-9641-2d83449dd4a7", "comment": "Malware payload (AgentTesla)", "value": "5ce0a19ca0adfef020f96630bd120b927992bf8f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410484, "uuid": "c3107783-1472-4889-b445-83b5e4de1edb", "comment": "Malware payload (AgentTesla)", "value": "9efa8069f13f52ae3f130e005915d8186a0476e8735cd97b2331349857470227af2d213e94e272ab7bfb1599b4ec4024", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410484, "uuid": "94054ddf-e112-4ae8-a1ab-eb36fbaa2393", "value": "37E423F3F7637F5AF6C24836962245A57FC89CA2337DFA805E7AB12858E3D920814714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410484, "uuid": "454d9ca4-a014-4eb5-bf2a-2cfbee43e1be", "value": "12288:q3PQ/cVHx2T73po14f+sG+sBaliwDD2esjsaB3Fqqc0QctCQ3hUBjz5qH:3cVxaZGK+soBUioie+ssF40QsCQ3+YH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620410484, "uuid": "96a79e05-5486-4f0c-8c09-237a1a109bf5", "value": 704665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620410484, "uuid": "5169e5a1-7067-4bdc-a84c-c63c3f6a01c0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410484, "uuid": "983365b0-2c9b-4b7f-b4d0-a4f07b3bce78", "value": "1a01b658_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b647c32-aed8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620352876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352876, "uuid": "1ff03c61-cf2c-46ab-ad12-5473de007d3a", "comment": "Malware payload (Dridex)", "value": "ee11b7cefa66a60c3211f58bfd258a92", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352876, "uuid": "05046166-1a2a-4151-938d-cdcb8c381058", "comment": "Malware payload (Dridex)", "value": "2b0bcfad8e041f98d2f647ace9ab7df6fb32b48497f55b1d39fb2ac2c08a860a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352876, "uuid": "fea4ccdd-5bf6-4c1f-9dc9-98d50dbca3fd", "comment": "Malware payload (Dridex)", "value": "35d17f739ac5f0fd30f4f10b5195d86a5f24593f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352876, "uuid": "742e85b8-18ae-45df-885b-d669f1ebd181", "comment": "Malware payload (Dridex)", "value": "2257037331d7c443f03a17daf372f9ffbbedd91731b179779bf41acfdd233d90a6381fd3261bfdf1aa6f06ef246ffeaf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352876, "uuid": "8deb399c-5d6d-41df-bbfe-0f77111c3236", "value": "AFF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352876, "uuid": "bf10785a-84ee-4daa-8123-23fdb187d080", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352876, "uuid": "99c426ae-b8b6-40d5-96fd-60737ceb47b7", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620352876, "uuid": "f473fb7b-495b-4d36-8881-1177ed3e557a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620352876, "uuid": "49d1009a-fd76-4b9d-8f34-e0c5eb2ee854", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352876, "uuid": "7f35fa10-7eb4-4b88-bdbd-468df681a57f", "value": "ee11b7ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc4583f-af05-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620372583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620372583, "uuid": "518bb561-f46d-45c7-ad56-ef364d40d1b6", "comment": "Malware payload (Formbook)", "value": "27a4ea6ad33b8e1e3cb9ea0e262dbfc6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620372583, "uuid": "ca80a1d9-8dc5-4908-9762-8bb0d1facc3d", "comment": "Malware payload (Formbook)", "value": "2b17837e2710c60fa874be6b28a89c8cdae41b004e85fcef8c0782b3cd1216a5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620372583, "uuid": "ac6b8933-8eb9-4043-bb62-987dffea3e8a", "comment": "Malware payload (Formbook)", "value": "55a9703dee40f97782f054c6433e181e196e1ae4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620372583, "uuid": "40cac7e0-98a5-40c0-9bee-1a4b515ec2c6", "comment": "Malware payload (Formbook)", "value": "41ad3dbd6f2c5522af5b8873a237e1b752ca4977bd61e502b85a3cee43d27aebb34492514073a032ea9fd28080ca3eba", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620372583, "uuid": "0f912697-0f8c-466e-b745-8f98d36540d4", "value": "4D55232CF8E13F27D76B097621A5D52800AFBF621319A817A26DF79A6DB1F740107309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620372583, "uuid": "d8865388-e959-4860-9b55-0f0cdfa3a5c3", "value": "24576:jHiEBBiMFHOQnS5irUZSAtuu17nlNF3RjDPjxp6Roth6HgBnNQ15n:xBBiMFHBS5iAjtb17lNBRjLjxlh6UK1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620372583, "uuid": "4f1b8488-447a-401b-9bec-7c2c3771178c", "value": 1360896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620372583, "uuid": "0c30be44-e4bb-4374-a913-c86a4b2132b2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620372583, "uuid": "cfa72421-acc5-40ef-9601-94f8b039c849", "value": "Payment Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80cc7bac-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403726, "uuid": "2b491f28-cba3-46b9-aa1e-c931fce7865a", "comment": "Malware payload (Dridex)", "value": "bc1f8e053f80b1b425f6a29c21382c45", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403726, "uuid": "7c54813c-6e09-4267-b2f3-d75820e34f2e", "comment": "Malware payload (Dridex)", "value": "2b3bdbd221cd8122fa783a749c0a12b9acd655d1090fda341b38b0ac4eff1b10", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403726, "uuid": "798c907f-95ff-4292-8102-c75fda9adaf6", "comment": "Malware payload (Dridex)", "value": "6676c8d3cb12ca199d01c136b34a85ce9d2fcf10", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403726, "uuid": "36b2ff7f-db32-4f6a-b28a-944f42ce9c2e", "comment": "Malware payload (Dridex)", "value": "54e41c1eda0e8801f21d0d8cd8b59675215c61ad0a4190656906463446f75b3566c8c923b04dfaa66223674b985f1941", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403726, "uuid": "057f7509-29a6-4089-88f5-42dc42ee8203", "value": "44F3D081E78ED5E0FC075B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403726, "uuid": "fc6867a5-c5ba-43df-bc05-6490b48f4596", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403726, "uuid": "14d8c73e-5b70-4489-a07c-de10f2dbd332", "value": "3072:vBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHN5:5uXLcclWEc2HeSjNjGdet5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403726, "uuid": "955a67e3-5586-488b-833b-6bf0a40d1a84", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403726, "uuid": "567f03f7-50d3-4af3-b8c8-fb4b487b578c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403726, "uuid": "d7b0b5e9-5879-4644-a582-7c8ef03a8f68", "value": "bc1f8e05_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44da6da-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620414094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414094, "uuid": "857fb129-f662-45ba-b5c3-2c895e38dc67", "comment": "Malware payload (Dridex)", "value": "c20a05caaf470d2867fad266444b7fc6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414094, "uuid": "10a24e1c-22ea-4514-a51e-8abd7c44c1cf", "comment": "Malware payload (Dridex)", "value": "2b4d276f1c4eb4c5efb1e9fcf6560eb9c195a4aeb7b02c663f9c495646cc7b1b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414094, "uuid": "1453a178-ec22-4ca9-a473-f7cefcd8ecae", "comment": "Malware payload (Dridex)", "value": "c4752be186aabc26ec214198493f5ae5732cc3dc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414094, "uuid": "b430a176-7339-42bf-b81d-304f3a8b0b99", "comment": "Malware payload (Dridex)", "value": "7068ddb69a289a732d349f9df0e14dd007b906a1a21e53d28208ac3e6dc49e1c3e259ca100c1f51d82721428c5f5088a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414094, "uuid": "a241b668-916f-4227-a4c6-44c83dafbc05", "value": "6AF3C141C9C5CCF0CBF36C364695963B3628B941995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414094, "uuid": "3d06423d-5ad4-4d57-b4e9-5c2f91c613b6", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414094, "uuid": "672ff9b9-c5d4-47cd-ba36-08b99918060f", "value": "3072:buFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+ke:b0czbty9uiaJlte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414094, "uuid": "a2eb0ace-ac23-4ced-bfce-e7c526f9be2a", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414094, "uuid": "6719da8d-381d-4531-aa9e-6e7c18be448a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414094, "uuid": "d67a3ebf-832a-4a16-bffa-582b69a81527", "value": "c20a05ca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7fb49a7-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404222, "uuid": "02b8256d-9041-4392-a5bd-d0dd97d88ace", "comment": "Malware payload (Dridex)", "value": "868eb891b142826e2d6173a40b3ce304", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404222, "uuid": "e95260fe-c421-41f9-b385-c804030544ed", "comment": "Malware payload (Dridex)", "value": "2b5bfad752440524d4a04a4332b31440de937ada7ba18447b02f88cb090ff077", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404222, "uuid": "754f3b6f-e160-4264-9d0b-aceb02876fa8", "comment": "Malware payload (Dridex)", "value": "b2661e7f03dca156ed0f50db4cbb32646ffcc8d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404222, "uuid": "84991108-8287-43c9-b727-dae1b21b6694", "comment": "Malware payload (Dridex)", "value": "00a4269b0a1ac5294f21107601d21ec9634df676fb973cd0de614cb4e6321930e5551f0dcaaa8d6bd6ec56d80049519f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404222, "uuid": "cba0fa59-7727-40e7-a5e3-e86ac1ea5800", "value": "97F3E081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404222, "uuid": "e2d65c90-af07-46b1-9c89-53251211c068", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404222, "uuid": "dc7433bc-59bf-4772-8e0f-cb9bb02bdeae", "value": "3072:1BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHAh:7uXLcclWEc2HeSjNjGdegh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404222, "uuid": "acf7b409-d91c-4317-ab0f-9e3ce8e7c8e5", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404222, "uuid": "63974e37-6b6d-4b88-9d81-76f80094d4f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404222, "uuid": "e8a40c15-57a3-4b50-bd3e-a4dd198e6626", "value": "868eb891_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443c63d7-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407061, "uuid": "2b482939-69d6-4063-8c1f-a0b896048350", "comment": "Malware payload (Dridex)", "value": "99ad0d8f5f128399c5e425d6676efba2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407061, "uuid": "bad778a8-5c79-44e7-b73b-b4b93e1b266d", "comment": "Malware payload (Dridex)", "value": "2b632db62c7ddba6e30b69016897eed18b392b5374fc26c1b69cc0a33ab88da9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407061, "uuid": "03f8af76-be11-40fd-b705-1c5f0e69a09f", "comment": "Malware payload (Dridex)", "value": "42ebea6fffe8f8b6e972e707d4966cf833ac2d21", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407061, "uuid": "04a4001e-235d-412e-833b-9c0214efa688", "comment": "Malware payload (Dridex)", "value": "4ca939e3e73cde9a8e7f5b0b7dc4674f45b0c6890f30d73b3a9b691208bcb21a630eb08319eac87549b886486e32d120", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407061, "uuid": "e5b6275f-c68d-43d7-8674-6264d1b72ab4", "value": "59F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407061, "uuid": "36659328-3b38-4ccc-becc-2e24bbc4965c", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407061, "uuid": "b92b60c2-5ddd-4173-875d-652d6ffbe555", "value": "3072:QBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:kuXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407061, "uuid": "f2d65817-ab11-4456-acad-d5d437c5771f", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407061, "uuid": "8ff5b71e-cda4-470c-a392-f99e0a63f753", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407061, "uuid": "440ec0de-14ef-4fb4-b76d-72c89a3c391e", "value": "99ad0d8f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f63f79-aed6-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620352276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352276, "uuid": "877d0a48-f732-4f7c-91ff-a02a7dade2bb", "comment": "Malware payload (ArkeiStealer)", "value": "4d3df6a13078b423f9be3b397e53e6f3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352276, "uuid": "af27df40-84fb-4663-b8bc-bc7d62e80138", "comment": "Malware payload (ArkeiStealer)", "value": "2bc31edc9fb8b51b6add2e52daa09a565b566dfc4db96ccb281ec1aae5d07512", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352276, "uuid": "d04ed4b3-5f0a-4b3c-80fb-fe4a58b0eb23", "comment": "Malware payload (ArkeiStealer)", "value": "686c00fc0265e60260be4fcd294b66c843dba1e4", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352276, "uuid": "3f90a235-8254-448d-a4cc-a3d08d4e0a83", "comment": "Malware payload (ArkeiStealer)", "value": "eaefbade6d1a428eedaee722a6bead4451dc0086874479f6dc13f63f0c3e1e2d9a47bdb3cc89c9a0e65c3a7855642833", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352276, "uuid": "bae4d4e7-d93d-4c6c-8cfd-a0618db9b551", "value": "D3D4E030B690C035E5F725F805BB82BC65397EA15B3C10DBA2D53AEE16386D5AC30B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352276, "uuid": "f522cdcc-9a70-4b00-a14c-12c33d14b137", "value": "ca69c6b93092b0d48acb97177d0397e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352276, "uuid": "359eef11-8d1d-41b2-9552-584de7d9d2cd", "value": "12288:urgU4f4pgrgTz42fP4XR4huTk8qcbOy2uFmWkR35dCiYcUOIFRHrY:uL4fCH4XguTk8qcbOyLkBfYcJIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620352276, "uuid": "d31fbde8-a2ad-4da9-8831-764313f80556", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620352276, "uuid": "b06da35f-5c25-456f-b0f4-7c23ceebfccf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352276, "uuid": "2cae0e3c-d4c2-46ce-8382-b48d20955992", "value": "4d3df6a13078b423f9be3b397e53e6f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5598aff-af36-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620393480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393480, "uuid": "91110d0f-ff8d-4e64-adfd-d91cdc66ccf1", "comment": "Malware payload (Mirai)", "value": "282218a809c54f9961f24b7c140b72c8", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393480, "uuid": "b98ed419-6c7a-40fc-822b-f7ff8bb3b4b4", "comment": "Malware payload (Mirai)", "value": "2c0402a272d59b373fd4b5f9383ec556b2821111216b4a9f2491ff7a26509c34", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393480, "uuid": "2fdb74d0-529a-4a2b-bcfe-69650d314bf4", "comment": "Malware payload (Mirai)", "value": "825d0ade403b5a369d75ff0867e5fd0a4a8aea87", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393480, "uuid": "2c9b672b-971e-48c7-97d9-b93a531e2d0a", "comment": "Malware payload (Mirai)", "value": "ed6a39f25f1d2d29d3ee984f7ffe30a59dbd4c31e0fb21b8d10e6dc212176a0dfec8995aa0a88c2045728e53805f5b09", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393480, "uuid": "128934b3-46e5-451f-89de-8ec6f7fd9080", "value": "F33308C4FA8B89F5D90749304067F13FCF31D9B941B1C6ADEF9A9F35CA67542920228A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393480, "uuid": "315246f2-5ba3-4f95-9881-773dc34ba588", "value": "1536:nfyMY0q0Yv5qP69Dj0MGNLTjlpDL7YkOY5tP:fyMY6Yv5qP6BoNLTZpDfYBY55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393480, "uuid": "f58e22ad-2297-47d6-9086-bac74f5714cc", "value": 54032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393480, "uuid": "4aba992b-2ef4-4470-ad3a-e2373068c745", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393480, "uuid": "e8fb1f37-e22c-49b7-8d3e-45315b48029c", "value": "badpackets.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580e149c-aef1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620363715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363715, "uuid": "782a7fbc-6b86-4439-a7f4-2949bdd46e34", "comment": "Malware payload (Dridex)", "value": "b1b86127c25c0500504782378af78464", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363715, "uuid": "af6c9cab-11cc-4804-9ab6-7f50ec67c770", "comment": "Malware payload (Dridex)", "value": "2c5bd62fceace753a1b82d1244e028747706ea0f2c2b0c4cde02670f274ffeed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363715, "uuid": "22d454bf-0775-4118-9fca-e55c747d1d7a", "comment": "Malware payload (Dridex)", "value": "bfaa675d818a742d536939cf726f235e8fb6c1d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363715, "uuid": "67046922-3e54-4cef-8c73-40ddd646c548", "comment": "Malware payload (Dridex)", "value": "1cdd474d285886492832d2eece36600f6835168bec2572ad12a6bc32e2c9c4b9c11a7ac62a2597e1b5756a7dec8548b8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363715, "uuid": "35e893db-a745-4aa4-b4a4-90305c8593bf", "value": "4CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363715, "uuid": "ad31ebde-05dc-4ccd-b3f9-c907816b747a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363715, "uuid": "50bb06fb-86e4-4ff5-a0e9-fec2dbc3ce65", "value": "3072:Mlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Mlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620363715, "uuid": "6eeefc13-497b-4aa1-a02f-3f69195ad1ed", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620363715, "uuid": "1f08da2f-6daa-479e-94fe-c986858156d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363715, "uuid": "adf9b2ee-9653-4ad8-b0f2-a6405a049d2a", "value": "b1b86127_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b239cae-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407072, "uuid": "deef90a1-d392-43b8-8a1e-18b4e0929ae4", "comment": "Malware payload (Dridex)", "value": "8fcae0185e32234fa4f5dea574eb5627", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407072, "uuid": "002df50b-fbf2-45b8-ab62-063ef74f798d", "comment": "Malware payload (Dridex)", "value": "2cf080b2cf6064c52dfd0793c368a7f3f941a263e2a696893323bd4db1dcc4d3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407072, "uuid": "46763231-5178-4e55-81d4-1c141df55947", "comment": "Malware payload (Dridex)", "value": "352a648d5f448686fa5b4c5845f659397235b2f1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407072, "uuid": "5f8caa9b-556f-4357-944b-b38b11694810", "comment": "Malware payload (Dridex)", "value": "a5ef2c46cab74c816672d34857135106568bd7d76619ba168772cd347bab0b239958e00a45d70ba82fea677bd865c7a1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407072, "uuid": "26212d03-215c-49ec-90f2-5188104438ee", "value": "4DF3E081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407072, "uuid": "2755e082-477a-400d-8261-322b17da5d5f", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407072, "uuid": "629355e1-4c76-4479-bcf3-ed8169770845", "value": "3072:+BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:GuXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407072, "uuid": "d9912489-cc8a-4b2d-88d3-13325fb5c667", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407072, "uuid": "35836c83-ac8c-4146-b86f-e65da451c0de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407072, "uuid": "425ecd53-beea-4753-82bc-44755cf786f8", "value": "8fcae018_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5980d739-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407096, "uuid": "d0b261e7-02e6-4461-80dc-53ab0d8472bc", "comment": "Malware payload (Dridex)", "value": "3d9466c006be424af3a5387dfc638241", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407096, "uuid": "190a573a-8119-4b50-91ff-62f12d13227c", "comment": "Malware payload (Dridex)", "value": "2d12f2f4d0b5be483a64e41cd0819768f1d9a0c297fc16f387dafcb5e675d125", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407096, "uuid": "58730619-c03f-4aa5-8d5f-0187196cf932", "comment": "Malware payload (Dridex)", "value": "1f49e65e4cff096e545167c6541db97166bad89c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407096, "uuid": "e5c1dd7b-438f-423b-bc80-373803172a97", "comment": "Malware payload (Dridex)", "value": "18c4ab7eacdb29cbcf0a045d1693390f5d3f96f257d85662bf7d5bd27a28703399acf4c8fc2800177e8c899625f2389b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407096, "uuid": "161ca265-8c5d-48b8-bea8-0d2a88570136", "value": "B4F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407096, "uuid": "6d22eac1-25da-4a6d-a1a3-a06659693515", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407096, "uuid": "965f869b-fb31-405f-b561-9e45e924871d", "value": "3072:5BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:nuXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407096, "uuid": "313a8524-70ed-4ac8-b438-b036c973a161", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407096, "uuid": "12280899-867a-44bd-95d7-0f5720379a8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407096, "uuid": "9002b0b0-8e83-4663-b784-1ae79549f9d4", "value": "3d9466c0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089d9f11-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403525, "uuid": "3c1f4307-1f41-48d6-b49f-4f7292892e83", "comment": "Malware payload (Dridex)", "value": "47b932a8e3872b888c11575794e4d5ac", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403525, "uuid": "fbcf9c76-c3b7-4684-a03c-d9507f8f8d4b", "comment": "Malware payload (Dridex)", "value": "2d4f959a1aecf17dc30b7293d9e12d7cd14006148f0aa6f8332a3db926ca3bcf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403525, "uuid": "533f0426-87f1-42b9-bf4f-545b1e4487c2", "comment": "Malware payload (Dridex)", "value": "5a084439f9ea939fcb0fccd7ca4b770e14c6171b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403525, "uuid": "a0556b56-02dc-4385-bcd1-c33661d76fed", "comment": "Malware payload (Dridex)", "value": "9756c6b2708f1dea5c2630e8407859e91c5b3f668804c8aca27b53e430fade238fd45e3338857f1ab923abb560aa0dd8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403525, "uuid": "9a863d24-fefd-49b2-96de-8d6d163591c8", "value": "46F3D141C9C5CCF0CBE36C3A4795963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403525, "uuid": "6a00f810-f21f-4bb4-9914-ef053526aeb9", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403525, "uuid": "5d3ec92f-19d7-4c27-9d60-ac0f375bd0a2", "value": "3072:2uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+l9x:20czbty9uiaJlA9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403525, "uuid": "1ef143ae-5e7b-433c-8955-bd6aa7fac376", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403525, "uuid": "3751c3b1-7278-4c34-921b-119dc1b9b545", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403525, "uuid": "78484750-24eb-4e09-afcc-d0f3d19b072c", "value": "47b932a8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14a9556-af09-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620374253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374253, "uuid": "f7417e66-fc22-4337-a468-e10f2681830d", "comment": "Malware payload (AgentTesla)", "value": "688fcf858494815d70acd0ecf3f01a28", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374253, "uuid": "4244dac9-e6dd-4aee-a1a3-972646470363", "comment": "Malware payload (AgentTesla)", "value": "2e5457602d420ce29d96c2b95b566976c2315b4bd73db3a18264c177d4bab60a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374253, "uuid": "2cf5622f-8236-4394-ac1e-2646134acea5", "comment": "Malware payload (AgentTesla)", "value": "26df4604bd57dc1ff23879c2e7fd919bfb734f7b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374253, "uuid": "76531d1a-7165-4f83-beeb-b7023ff5d159", "comment": "Malware payload (AgentTesla)", "value": "75afb7f6f8884d5fb2814b011eb2098c25e66efcebee83249ab7ec939925f199792726e5002649ca135a3fa54da073b1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374253, "uuid": "ce668dae-1519-4050-989f-81ceeb8b956c", "value": "8EE43367285B345E664316A3E25B90F87EFF7A421982FF2C245A12FFBE3D57411042A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374253, "uuid": "c971c3e3-4131-4c68-8f2d-9a73e0b040da", "value": "12288:z6uFzj/SxtM2h6x7KrEF9z5CiIygK5lGcphFKhKn2N/Lck3ygoVTwon:zwx61Kw3zUiI85DVKhZNCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374253, "uuid": "1bf2f94c-7397-4954-b4a3-9a9c97bff365", "value": 662638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374253, "uuid": "bb259527-c089-4bd4-b44f-df0d0af8498f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374253, "uuid": "201cd9e3-fdec-4831-9d72-216b801869dc", "value": "260337100 HBL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b37fa9-af44-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620399440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399440, "uuid": "d0108869-7aae-41ec-86bc-2d924961789e", "comment": "Malware payload (Dridex)", "value": "3d0704fed94d48905669c6a6ceaa9872", "object_relation": "md5", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399440, "uuid": "bc8df8dd-d191-4175-9e82-4e6be4de9aa0", "comment": "Malware payload (Dridex)", "value": "2ea1d86f48ac4d38454b3c56d04781afd37e5bc0e394fd84df3e0d3418024f86", "object_relation": "sha256", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399440, "uuid": "c0d608b4-f9ce-4002-8948-82c01c9b140c", "comment": "Malware payload (Dridex)", "value": "de095053384c7e1e33fd4ac090cba8db0e3d9a47", "object_relation": "sha1", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399440, "uuid": "93e7463e-619f-411e-a10f-2d61c50582fa", "comment": "Malware payload (Dridex)", "value": "a8e512c44cb0e8b5d803aaa76ab2d3c5c258276955d0d8d4a39eee04f0d6e1833c664add25da39ae5d617ca0d5787797", "object_relation": "sha3-384", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399440, "uuid": "8168abb2-d4b5-4fae-a3d0-f050f21c2c4d", "value": "622413A9CCE6F21BCF53283E46996FA37A53595281F3BD1CBA19F63CB948D0354800D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399440, "uuid": "864c9984-0864-4959-af2a-e2601ec1bf04", "value": "6144:rJfMho/IO+/ENhLv5xyGBVeJZnC469axilrxD5y:rJfMho/n+crRBjeJZ369KYrxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620399440, "uuid": "2eabbd7d-1b76-4342-9581-f7b0ca74a13c", "value": 224872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620399440, "uuid": "53a96fb3-4fd0-4311-89d3-fa9276bbdf12", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399440, "uuid": "30c3154d-c9c0-4301-8462-c139fea13065", "value": "generated invoice 6965.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2dd39e2-aee8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620360055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360055, "uuid": "03329c5e-4f7c-4e15-b0c2-2b0d6447face", "comment": "Malware payload (Dridex)", "value": "a8f687e925ff241f59bb13a594b11694", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360055, "uuid": "5b6d65b4-1d8a-44ec-953f-5cdf0b6c1e3c", "comment": "Malware payload (Dridex)", "value": "2eaffc1f4928fd5c3efd764d9bf52847a355ae3f9da259044e26d7283a1e4265", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360055, "uuid": "30272f60-6ffb-4bce-8a02-bff9b636a6de", "comment": "Malware payload (Dridex)", "value": "15c1712eb38ab70c1208b26f52d66e44a6912308", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360055, "uuid": "2cf4db86-5ad6-4bf9-8feb-b0d115fd2659", "comment": "Malware payload (Dridex)", "value": "a0f971ac6d0b4aa258f2c29a97e8a7a3e18ea0bc1ddec509ba8d5ad6df7c92f25437fefa8cfd91cb047e01aea78fb09a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360055, "uuid": "8c239cd6-26d1-4f9f-923b-e1eb643b1002", "value": "C2F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360055, "uuid": "3e743308-dbfa-4d8a-bc8a-383acd2a7888", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360055, "uuid": "513813d3-8af1-470e-9601-236a25f2fec1", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620360055, "uuid": "ecadb6cf-f2de-4928-84b4-d5c9cf85930a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620360055, "uuid": "304f476e-88f9-4a99-962c-7d851c7afd50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360055, "uuid": "a57944f8-4eb6-44bd-ae5c-1644e0ab51ec", "value": "a8f687e9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9d6323-af6e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620417648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417648, "uuid": "ff60c1ba-c9fb-4745-aa11-c5e36d6b8b40", "comment": "Malware payload (Dridex)", "value": "73966e3886228d684a52b90c3c472a21", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417648, "uuid": "fc706ff0-229b-4913-8128-0a737e5002f4", "comment": "Malware payload (Dridex)", "value": "2edca93532fecb432dac4aec9456a9d0b9d11cd1c61948f2f88c3ccd9c090fbe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417648, "uuid": "d260b741-a2c7-436d-89f3-1b2e8d407367", "comment": "Malware payload (Dridex)", "value": "cbac01ce6a71a718614211a2f6d2ec7f336e553b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417648, "uuid": "29e56c8c-3628-471d-9b4f-efc2f5b9eba1", "comment": "Malware payload (Dridex)", "value": "ab844eb3a46dfbf98ed87749c325a182fde982702450b6e1cca6900b946ce0774e34d8532180bed37d1a6ee698254273", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417648, "uuid": "ce57da42-2618-4c82-93a7-762f7a082b99", "value": "9CF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417648, "uuid": "546cb337-05b8-4f22-a42b-b1ed3a630c64", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417648, "uuid": "de20e819-1a9e-4bcb-a7f7-d9544abcd29e", "value": "3072:UWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:U42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620417648, "uuid": "3c58c49e-bdd6-40a9-8960-4834baa9c1e3", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620417648, "uuid": "8b2fa0fd-7df4-4412-a158-69269f5f6cdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417648, "uuid": "6c699c9a-bece-48d3-aaa4-3573d3a34cee", "value": "73966e38_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd66e92-aee8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620360072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360072, "uuid": "46f5ccba-bb99-4e2d-951f-d4b1a4d1b4c1", "comment": "Malware payload (Dridex)", "value": "ea67a29eda4defc138ef691d2081ab69", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360072, "uuid": "fab2ad1b-9f47-4623-bec1-fde5f701ba09", "comment": "Malware payload (Dridex)", "value": "2efda6cc3b968abb2840d0bf65e02d0aa3633f536f78f3bbcdf09232a26d8bba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360072, "uuid": "283b08cc-8297-437f-8c99-44caf5d5c0fa", "comment": "Malware payload (Dridex)", "value": "a47b91318bdc5d99b202790695d39335031440ef", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360072, "uuid": "4942a38c-88cd-49b4-a9b3-dccde018cb5f", "comment": "Malware payload (Dridex)", "value": "4225b7cd77bad784182f75f62836d412009b8ccca307b5b03c24508d16e267eb93d88f7a892c1821aa44f44ffbae29aa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360072, "uuid": "196003db-ae8c-4c50-83c1-c5752bb29bc9", "value": "59F3D088CBB3E4E6EFB3D37866F85E1B4A1174551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360072, "uuid": "c43b4510-eb24-402f-b4ca-dbf0b98cba14", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360072, "uuid": "1e4d3447-3c41-48e8-b9d2-67700c190bfc", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620360072, "uuid": "43351396-048a-4582-aba1-d9032384b2bf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620360072, "uuid": "76918490-c176-4ac0-be1e-1f2a84275fc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360072, "uuid": "4528de37-9d4f-4c58-ae7d-8f3906aef558", "value": "ea67a29e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e8e60e-aee8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620360034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360034, "uuid": "09603a3a-45cf-4813-a754-d6343a4c0add", "comment": "Malware payload (Dridex)", "value": "3e24378350e2f5a450e0f424c9b4af7a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360034, "uuid": "07352a1f-64dd-4c6c-b70a-4014a0e5e895", "comment": "Malware payload (Dridex)", "value": "2f40eec350c662f65b5d580d8c5f4ab1717238f2e52f2850c6dab6093d1ba860", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360034, "uuid": "f300b1ec-2e2a-4e92-89a8-a4389741f46c", "comment": "Malware payload (Dridex)", "value": "6d2994fc9ec109681dd5cf4e0718cb3818545235", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360034, "uuid": "e64315ad-ddd4-412f-8a4d-864da1305888", "comment": "Malware payload (Dridex)", "value": "1b6643ec9782d37b9039715b69299fabaa00de0c910950fd21fe62602598050c50651eefee95f9c266110522a1c6e8f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360034, "uuid": "89306987-8cb1-4f3e-b77b-d4481aad5ecf", "value": "7AF3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360034, "uuid": "bdb0a56f-84fe-4aa9-8210-efa056f96bbb", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360034, "uuid": "9c6f7b3f-6f3b-4bae-ba8a-7149fc74cf0f", "value": "3072:+WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:+42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620360034, "uuid": "e85d3858-8b90-45c5-9b49-fdc93cfef478", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620360034, "uuid": "96977a6f-c055-421d-8582-43e14f7dce66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360034, "uuid": "75133ab3-fffc-44bd-b1ab-f973837d7b45", "value": "3e243783_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c4b171-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404236, "uuid": "0c9fd335-f104-45c4-831d-73b7d5907d1b", "comment": "Malware payload (Dridex)", "value": "05cc9a458c256b00fff86061975a6c83", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404236, "uuid": "e045320d-5346-409b-9919-2d7d6a7419bf", "comment": "Malware payload (Dridex)", "value": "2f5b1b39cfc26ef745d307fa1759660b1565cbca69ff9193f3a0ea28901d7826", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404236, "uuid": "2fb26d78-4d8f-4e47-b9d7-48e5416ab230", "comment": "Malware payload (Dridex)", "value": "7716f8b27a02a9e948b3f719f13bdc175ae024a2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404236, "uuid": "c88e16c0-12ca-40e9-80c9-6a53dd402c9c", "comment": "Malware payload (Dridex)", "value": "bd6c2c074e379fef24fe41c69d5509851ce93bd1da23aca5619321fd3c1492e7f711ca0d371527edae1d4ce81958967d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404236, "uuid": "163a19cf-0afa-4497-bd22-83a145b3c8bb", "value": "D9F3E081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404236, "uuid": "1db50b94-e261-45da-9afe-1636564ce267", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404236, "uuid": "de7082ec-fe40-45e4-8aad-b49814539222", "value": "3072:2BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHAh:OuXLcclWEc2HeSjNjGdegh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404236, "uuid": "9d462c71-6fcc-4a1e-afa6-04a47827eb6f", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404236, "uuid": "1906d22a-9bb7-4b9f-ae6a-790258b20b86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404236, "uuid": "32b10c9b-fb5b-44f0-97c5-0fcb08625bee", "value": "05cc9a45_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8a058d-af88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620428439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428439, "uuid": "b563c095-aa13-4540-822d-5c1b97c87be6", "comment": "Malware payload", "value": "ca66ce177e27452c2d409aba9c739244", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428439, "uuid": "a2170d54-4d5d-4bc9-bc4f-30b0ffb61953", "comment": "Malware payload", "value": "2f7709aaeb5c8e3fb1c070d8f48d1416b27b30bcccc6f1b297e1edf3107cbb23", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428439, "uuid": "4a3ca0c6-cbb4-4d5b-ad8c-0332dbb9b994", "comment": "Malware payload", "value": "cb35c2c53a9eefd09f992925a34a9d7ce9eb1ee0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428439, "uuid": "9652d7df-9483-4d8f-95ed-13f8d202abad", "comment": "Malware payload", "value": "2c69c7de93cf503fbba3fa6819fb60f0e830f7b85f73e692c38e95cf63471c9319d883cd1baa410db9e6c4fc9bafd352", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428439, "uuid": "fefaa500-6202-4118-8136-be14367e8e04", "value": "E8F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428439, "uuid": "4374e2b0-02c3-484b-ac96-857e3f06fa8f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428439, "uuid": "864a6757-535b-4d8f-b35c-5ceb6f7ab1e5", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620428439, "uuid": "1152af10-e750-42c7-a609-fda8e063cd82", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620428439, "uuid": "b1432f66-104b-4101-8ba3-072e06873c87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428439, "uuid": "cdb523a0-db37-4071-9dfb-fb710344b2c4", "value": "ca66ce17_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36820324-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407467, "uuid": "9a8b72a5-10ba-4cff-9a68-6ba7a340ac10", "comment": "Malware payload (Dridex)", "value": "9b686d32272a408cbcfe98864601c088", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407467, "uuid": "507b73bc-e339-4981-b1f9-48001d8cc3be", "comment": "Malware payload (Dridex)", "value": "2f9f1f21238688ba630be5555413e8215ba96b4d165982ccd46c45b1b7d249aa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407467, "uuid": "c40871b5-067b-446a-b10d-f87f20d4077b", "comment": "Malware payload (Dridex)", "value": "c19c707f209e16f527d665cf13557bcca6c4bc5d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407467, "uuid": "97b0ae13-2007-40c6-acef-d035cb674ed4", "comment": "Malware payload (Dridex)", "value": "cc40bb3e235140100eb16c250a5605c738d08d630114bc1117cc61969d9e8d79993c84fd0f90730c7d044ffd36464193", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407467, "uuid": "d57905bf-6f28-4c14-8c93-05556053eb85", "value": "0CF3D081E7CED5E0FC079B333EA80EEF52310087691954E4EF29DABD96BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407467, "uuid": "2772fd50-8271-40d9-b610-73fa8d5dc64e", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407467, "uuid": "c752e0de-132e-47d3-a933-4eeae6a4827c", "value": "3072:zBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eH5O:luXLcclWEc2HeSjNjGdeZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407467, "uuid": "99ea77df-af1d-4b36-a135-ab380b45bc5f", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407467, "uuid": "0968c253-6866-4803-8026-b56902411a32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407467, "uuid": "5b9704ca-6e52-4fff-9d17-e86c75ad4bd7", "value": "9b686d32_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa3263d-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403474, "uuid": "e3d35a26-1b1a-4703-afa7-ab071e7098d7", "comment": "Malware payload (Dridex)", "value": "3afa17b65c15a7360961d42fd920ac2f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403474, "uuid": "966c92b3-6a37-4c92-81d0-ac5d625cf52f", "comment": "Malware payload (Dridex)", "value": "2fd0b45a1d4b23660cc15186cf6ffcde9489c8930806e18d49b1af80c7a34a12", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403474, "uuid": "d64042a8-29a7-4273-b2e0-106d83105223", "comment": "Malware payload (Dridex)", "value": "1c218fdc4140c204155a4698a37e8464215e519d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403474, "uuid": "06245135-ad39-49df-9adc-33f6169575ed", "comment": "Malware payload (Dridex)", "value": "a4b077422e3b911b110551f3d54dbc64c49a4d43e5af00e0d9d60790f7fbd4798873054b020da249ade0498df936aa1f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403474, "uuid": "2ca00d98-bcfb-496f-a436-690669ee0078", "value": "28F3D081E78ED5E0FC075B333EA80EEF52710087691854E4EF29DABD96BB7E051A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403474, "uuid": "d16041de-0fca-4e8e-adf4-ddae22299d67", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403474, "uuid": "630b8d43-9c3d-46f9-8573-28883af9f38c", "value": "3072:1BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHVR:7uXLcclWEc2HeSjNjGde1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403474, "uuid": "ea020e71-7e1d-4ae6-8fe9-589c7e1d9317", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403474, "uuid": "569ddb2a-48f7-4073-8f66-10281839c9aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403474, "uuid": "587691d9-847d-4459-b9da-608211b8afdf", "value": "3afa17b6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9898827-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620414103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414103, "uuid": "4be95cb2-c44f-4dad-b937-d803556ac2d2", "comment": "Malware payload (Dridex)", "value": "b169af27e98761284dad12c37f886846", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414103, "uuid": "b032af4a-edfb-44c6-9298-e75d3961633b", "comment": "Malware payload (Dridex)", "value": "2febf1ec437be67bb8d828de28083c14c298065a68b2331024e7fd98197ddf1d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414103, "uuid": "af0f3847-45f7-48c7-a0ba-c59e6396851c", "comment": "Malware payload (Dridex)", "value": "3d8a99816c5fbec1ac65f64f1bc083c39c6fa0ca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414103, "uuid": "18df0852-cad9-4add-9702-e410e4aa5d63", "comment": "Malware payload (Dridex)", "value": "002ad2734bdcf58d2a6b324c137c0ab606b92040285c66e1cc677ee0875f83b765b4a274c84e8ff993c4344b8d0b1926", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414103, "uuid": "0f8f4f42-a578-451f-b0c6-e19349cd7892", "value": "C5F3C141C9C5CCE0CBE36C3A4795963B3728B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414103, "uuid": "aadc38df-f66c-474a-95f5-06e08ec7d1cf", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414103, "uuid": "8edd69a0-321f-4b8f-9a7b-1445387c03a7", "value": "3072:JuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+ys:J0czbty9uiaJljs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414103, "uuid": "0edf72a8-5317-401e-a44b-0e89e6ab05df", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414103, "uuid": "32dc19bd-de4b-4c45-bf69-302675858f33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414103, "uuid": "ea5ef7fe-61bd-4ca4-b268-74166ecd772c", "value": "b169af27_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b081c4ad-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392210, "uuid": "62895bd3-6a7a-4b26-8739-534f52fabc4f", "comment": "Malware payload", "value": "b8157f9f017b31b79b7d4f0967ba1e79", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392210, "uuid": "5503c969-e746-4522-9354-bb1b628b0ec7", "comment": "Malware payload", "value": "300a8f72d86141d081371b45d5c1d5d921c593985cb545d8ebfe19d904250d0a", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392210, "uuid": "b024d9b6-c659-4928-908a-2fba2c309987", "comment": "Malware payload", "value": "41a7d70625087f28d83a992b79da785ef1f6c20f", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392210, "uuid": "dcb4e4ee-2823-4a15-944b-16429639add1", "comment": "Malware payload", "value": "5f750e6aa4d42b38c612ed2063171bb5fbdc3e33b494034f51d61f003869e96b4d35ea9fd095a66c37ef2374552fe3f1", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392210, "uuid": "4d5491d4-5a8d-43e8-8d4b-3a51f7f0d757", "value": "F1A1F750112C1AB07246697AD26FFB52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392210, "uuid": "be871ef6-564a-4031-8d14-45e8abfbeba3", "value": "96:zRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:zRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392210, "uuid": "c3ea98c7-f7ae-4393-b658-79491868067d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392210, "uuid": "3e1404e7-0462-45b4-84fd-27ae7ec63cf5", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392210, "uuid": "53714ebe-7fe0-4bc4-9c90-c57296021154", "value": "300a8f72d86141d081371b45d5c1d5d921c593985cb545d8ebfe19d904250d0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e3d26d-af3c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620396081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396081, "uuid": "29c0ccb9-6f5f-4539-8035-d4a55d9f1f1f", "comment": "Malware payload (Loki)", "value": "f43075c01cfe6faf53c087ab93a56767", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396081, "uuid": "e2281ee3-6afb-4108-84a0-8574dc24c9a3", "comment": "Malware payload (Loki)", "value": "30325168f0fffaf2d28d44826667d5178ff2788cb93a0449897800c2f2ba2e6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396081, "uuid": "2f022bc5-b2d7-4f62-9ca7-a03b3387b6e8", "comment": "Malware payload (Loki)", "value": "a536c5fabb645e06d1f9fe01ef04ab8ef7ef87a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396081, "uuid": "be829b38-6320-4d31-9517-64fb6352497c", "comment": "Malware payload (Loki)", "value": "9543edf61f25cd538868a9a2b7ca9cb64d031805e6dbeafeabcfce3329ae9d6795da087569432ce9ae52b140b16d89fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396081, "uuid": "76fd14a1-d9fd-4a37-b4c3-fe4731d96b10", "value": "4FF3F1D232C0C4E3D3760B702D325D1FBBA7AE681106964F67A8BA5D7977AC2941F113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396081, "uuid": "d8b3db28-759a-44e4-8e4d-05297be39418", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396081, "uuid": "c0daa73a-0ae5-469a-ae1a-26d1c9e6e55c", "value": "3072:jEre7GjyCaFvciT/5Dfri5g/fnbTi6u9FoYIDHtxApe/O5XLoIxmjm4Gm5DFoVbx:jPXPcCYITDAppl9ojm4DqVbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620396081, "uuid": "a269be17-d2e8-45b8-ab92-1879f5e04864", "value": 168862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620396081, "uuid": "3c6fc9b8-a09c-4026-8942-990033ea9115", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396081, "uuid": "ab849518-3baf-466e-a5bd-c8253f2cad51", "value": "F43075C01CFE6FAF53C087AB93A56767.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b122e583-aecb-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620347543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620347543, "uuid": "7796f28b-a77e-4d2d-aff6-ffaa1cee2cab", "comment": "Malware payload (ArkeiStealer)", "value": "065b932102b074310dc0badd04eb3c87", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620347543, "uuid": "ccd81731-c82e-4204-88dd-99dd60d31f47", "comment": "Malware payload (ArkeiStealer)", "value": "3033f90542b1c69f80c2a5dbe6e5867f8b94edcc2a69bf143678ab2d323e2a9d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620347543, "uuid": "2ca2cb8e-40f2-4dab-8a8b-7c381fe5747c", "comment": "Malware payload (ArkeiStealer)", "value": "964fd63852aa20d1bebb1f7d6be712af5f62a195", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620347543, "uuid": "dac2291d-08fc-4318-b54a-879139a5c36f", "comment": "Malware payload (ArkeiStealer)", "value": "01efaf18060e303fab7057939e6ad394aa900fb660d9362f0a3be00be1baaafc0b29105c2704fd5366efd70b54b39e7d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620347543, "uuid": "b5d2b6bc-03b4-42bc-90ba-ff0cff0c83b3", "value": "F6D4E030B690C035E4F726F455B983BCB62E7DE1573441CB62D43AEA2A746E8AC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620347543, "uuid": "030e37cb-ec42-440e-bdd3-7505c9a82381", "value": "ca69c6b93092b0d48acb97177d0397e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620347543, "uuid": "3da8d321-afc7-4757-acaf-649414f863f2", "value": "12288:prgU4f4pgLQpZJ3vWYZT+oFnNhhhXINF1+yaHdpUL:pL4fmNZ1FnWv0dpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620347543, "uuid": "f6768958-75e4-4144-ba0b-e7005d3fbcbf", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620347543, "uuid": "3345ecb0-0ece-4c24-9be9-8292a2ef68ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620347543, "uuid": "2536052a-7cc4-4994-a6c9-f4a2bad2f17d", "value": "065b932102b074310dc0badd04eb3c87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3dfbdb-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403876, "uuid": "8c5e5459-5389-4784-b6ff-6ce648b008ad", "comment": "Malware payload (Dridex)", "value": "3892556643e4eae875da4fbe62c5c70b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403876, "uuid": "d53a12b9-d286-412c-806c-99de403517bb", "comment": "Malware payload (Dridex)", "value": "305ee1ff065336ab2bc5979883f68b80781ad3bad674826902b6c901066c58b6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403876, "uuid": "66729247-180f-4e56-a653-5b31b667ca29", "comment": "Malware payload (Dridex)", "value": "60a90be91c5a78131580cae72ca4c55e646405a7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403876, "uuid": "1e6d8f5c-1abb-4843-b622-fb4fa59715dc", "comment": "Malware payload (Dridex)", "value": "0759f1a7e5201893b4ec3367892316ce6acabb9dd16fbae949fd34859499151c22cdc0144acb8cc48499151547c8c3a1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403876, "uuid": "07b9e62c-1aa4-4f94-ac25-864cb09118ca", "value": "65F3D081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403876, "uuid": "10eaafcf-1842-42ef-bf2b-125c59317713", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403876, "uuid": "c064d523-f07d-4c72-9bfc-56c2a6729ee5", "value": "3072:wBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHcY:EuXLcclWEc2HeSjNjGde8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403876, "uuid": "5c768921-f60f-495f-b62c-2d3b23e24b47", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403876, "uuid": "c2a39176-f76c-4aef-a5a1-97cf2562f690", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403876, "uuid": "3eec4be2-a25d-47de-aebb-4c731d50a492", "value": "38925566_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1559a3-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403958, "uuid": "51fb0c0e-c250-4012-95e1-29d27fbc659a", "comment": "Malware payload (Dridex)", "value": "f8af4268a7cacd7c91b79b557edace5e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403958, "uuid": "eaa8dac5-dc4d-4f94-a382-1998010e92e9", "comment": "Malware payload (Dridex)", "value": "3070247d5833f41c57e5304ba9a4f44da33ff9d3ee7f58467c2f756ba9873b9b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403958, "uuid": "a65de1a7-58ee-4aac-85e6-89aab7fc790a", "comment": "Malware payload (Dridex)", "value": "462db7e0383c192de51e85d544f26f14948dfd94", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403958, "uuid": "e8c5ad60-19c1-488e-b080-ffa6f0e37335", "comment": "Malware payload (Dridex)", "value": "77b5db189835eeb78df9fbf0f18739dece090a46ec8ab80ef1730f52546a24cfa270a7d04f8685e4ca9e03d20857ac37", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403958, "uuid": "79aceb4a-1b24-4a0c-9d32-d1fd8547fe44", "value": "8DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403958, "uuid": "804f44cf-4f5f-42d5-8f77-34f0ae605245", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403958, "uuid": "c4c91834-6f0d-4bf8-b8e8-e1a60a93da57", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403958, "uuid": "e8b3743b-1ecc-4519-b75e-853ce30a10ae", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403958, "uuid": "ad55e892-6633-4f9e-8b91-cd7035fe5ed7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403958, "uuid": "5fd20ab0-51f8-4143-985d-977469e32c01", "value": "f8af4268_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27cd965-aef3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620364806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364806, "uuid": "c5975300-daed-49af-98ef-c18dac961834", "comment": "Malware payload (AgentTesla)", "value": "d4edfaf6e8bb49f0342b49bc796ac97b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364806, "uuid": "767bdd0f-a809-4e24-9390-46e04da0536e", "comment": "Malware payload (AgentTesla)", "value": "30718874b90d12365b221766d1fad7e2dc3301d3898e071a082ed9fb9bf5ec22", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364806, "uuid": "79686aa7-ab87-47c7-9657-b75d4fa694a2", "comment": "Malware payload (AgentTesla)", "value": "2579ca8ea189406c20d80a2e49c09436884c9d46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364806, "uuid": "4e169bf9-0ccb-45f7-8c1e-956bee364700", "comment": "Malware payload (AgentTesla)", "value": "7bf1d30aa0148c7dec49079d657479a33b15f2fcc32ff6d25344933233d762a3f0e268ef840f83e03db46f62f6be76c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364806, "uuid": "e7d644ef-9d15-4b06-a19b-078d9b1bac54", "value": "B3F4EF262385CA60D93E8734D06063F027E2BC11F722DE1BEDC57D9E797AAC14769683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364806, "uuid": "b891c5d3-bfa2-4cf3-b23b-2847aa8e46fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364806, "uuid": "12b4441a-091a-418f-9f58-8f0e0ac2f3cc", "value": "12288:FDiAV6QjoxHFZEKO67fNqa0DUx6jrGLqmb0qZrdAHbAvsM:FegeHFZO67127jKLqmb0qIHas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364806, "uuid": "2d830b7d-2ee7-405f-ba9b-839d595dd43c", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364806, "uuid": "17a28905-cddb-4bcd-aec8-c75ad249f969", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364806, "uuid": "aa98def1-9de9-44ad-b247-4b37ba681fd6", "value": "PMSHIPPING DOCUMENT & PL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0bc56a-af12-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620378141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378141, "uuid": "96e18e55-cdb9-4c33-8e7a-c9284c0b20b1", "comment": "Malware payload (Dridex)", "value": "352a04ec7b72fe8e32159f45d5fb23ef", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378141, "uuid": "dc370a76-8ef3-4084-9715-80362c3472ae", "comment": "Malware payload (Dridex)", "value": "30a97424d9d3de60c345ae4ad2c8b5d9d80f5b79157ab5c0a1a8b81adc973b4e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378141, "uuid": "d8902853-ccaa-4680-9d89-0ae8c7a6a751", "comment": "Malware payload (Dridex)", "value": "9bbf028c1c027bc20f5ceb1774f15b65faecce7a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378141, "uuid": "28814210-50b2-4971-9fb1-2b4591eabefd", "comment": "Malware payload (Dridex)", "value": "c6c6485b6ca7477ef6a984c538706630a92766a6ba5c7533b792158bed76a2720204c58b171e0d1c003ed460c3130d10", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378141, "uuid": "3fa50317-3970-40c4-ad7e-0ce79397dea3", "value": "AAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378141, "uuid": "73084124-03b9-4e95-82f5-1d147043a208", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378141, "uuid": "65a64d9d-5ea0-48f3-ba88-037fe4ebdefa", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620378141, "uuid": "13be4fd6-ebd5-46e2-971d-79ec83e812e5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620378141, "uuid": "8ae92a4c-af01-49dd-9c24-d620b64cb41b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378141, "uuid": "bb50bef6-09ca-4ba7-ac09-5018c3306488", "value": "352a04ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e829d7-aed8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620352861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352861, "uuid": "65d0fc2e-92bd-4333-b754-af8f670376e2", "comment": "Malware payload (Dridex)", "value": "9c3fd1c0162bccd130d1800ba6d8e4dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352861, "uuid": "3f6a6ab8-1b86-4d16-9f32-7e5bc3cb0f72", "comment": "Malware payload (Dridex)", "value": "31201e6e8c32ee9c6899390849a2da5f87a2bb6bd256b4a5eebef020efa61559", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352861, "uuid": "3927ee16-af15-412f-ae0d-ea5ff4d21395", "comment": "Malware payload (Dridex)", "value": "a4db7e1e3b08f44ed10c223acdd856fe9107d759", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352861, "uuid": "1f91d462-e675-49fc-b971-85b383a466f2", "comment": "Malware payload (Dridex)", "value": "b691b4e6f054701e2fdaee8d891ef26902367744ccb30e3684255e4e0e30068751dedd1fa07b554be7616e6b5062617b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352861, "uuid": "d8a53585-d06d-4591-8c5f-c056742ad7fa", "value": "9AF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352861, "uuid": "f6153983-eb51-4049-b3a4-57f8bfa4437f", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352861, "uuid": "d7e68434-4b8c-48e5-8573-8c362ffb78c7", "value": "3072:SiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ReAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620352861, "uuid": "6bd86e3c-d799-4b9d-8423-7f06491c1ce0", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620352861, "uuid": "d67f775d-088e-4f6e-9c59-573e77fdf49e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352861, "uuid": "aa2dc0ed-5585-43f7-a8ba-d24e349c1d79", "value": "9c3fd1c0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e065677-af1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620381764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381764, "uuid": "3fc8c906-80a6-4930-a0c3-d672c911e983", "comment": "Malware payload (Dridex)", "value": "4de6b7ed2b95382758ae51a9d694bd3f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381764, "uuid": "d702c614-9fc3-430e-80c2-bd85acf9eaca", "comment": "Malware payload (Dridex)", "value": "312ad663264ed55e6bb2e9183ec39a45bec99283ee86536573da236d5ead8a18", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381764, "uuid": "bdfab47d-4e5a-4b83-9d97-906d733a8fdd", "comment": "Malware payload (Dridex)", "value": "97545e6b63a1c998803adebf96a0bea3db9b3887", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381764, "uuid": "3ef04dec-4d88-4ba6-848b-43f568069599", "comment": "Malware payload (Dridex)", "value": "2d7658934186ce53eb82edc659fde6154b419e6e4e4eccbb1f7673e6acba0097bf00c05f4e118235910a724e947a4681", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381764, "uuid": "695d8af6-6c01-4bec-9e03-5746eb12dc67", "value": "CFF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381764, "uuid": "27a97318-efb7-4b30-bde3-cb13e5a966a8", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381764, "uuid": "e9921921-c6d5-45de-a031-2a81f619bdb7", "value": "3072:4iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:DeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381764, "uuid": "0af94e36-a818-492d-8626-2b6d2e1644a4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381764, "uuid": "338c911e-3f7f-4a90-b651-e20d88aa12b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381764, "uuid": "1b6787d6-61af-474b-a0a7-36f42e3d42dc", "value": "4de6b7ed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5707ae9d-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620385188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385188, "uuid": "327d4af3-477e-4c1e-9fc5-ac1affda24eb", "comment": "Malware payload", "value": "674d01a41b61e42f0b7761712261e5dc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385188, "uuid": "fec762c5-5260-4a34-a969-3b17e846aa82", "comment": "Malware payload", "value": "3142397ba09a68329f93013aeee8ea89c84c01a4e6f337502d8f13f8da74660f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385188, "uuid": "596276b1-218e-4c51-9677-1adb58b92f95", "comment": "Malware payload", "value": "4edd3b1ae2284db54b504258a9d8c54f1dc983c8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385188, "uuid": "427d6e34-b4de-4579-9987-7f71484ea04a", "comment": "Malware payload", "value": "c8bdc1ea6d08b25f625229e05d49e8c80bf286e51f8ec603e6f6f101331ef02855d9cb37d28addb2fb8a34490d2d5a0d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385188, "uuid": "69e196d4-f910-4d22-9f34-ecd2c88169bd", "value": "F152D09CAB96F925C8EFFBFC04E21232B53B4C29493FEB4BB1186DE3451135866449D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385188, "uuid": "36273e07-a282-4744-a615-9f5d29de5242", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385188, "uuid": "afe7b775-bf03-4392-afdd-b9dcfd94efbb", "value": "192:GvVQCZw3nCAVS25HPlikJgbn+oqoIfjJQ605fiOczlY9VPclSSZ7Q33vx+bdu5sX:9yKHVVoILl0YOcz4ZHsdu5squ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385188, "uuid": "6f7f8fb7-935f-4322-a8db-bb61069760ca", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385188, "uuid": "9488028c-52cd-459e-94be-8b299291e6f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385188, "uuid": "c1d8e576-52ad-42fe-b812-0574c591fa50", "value": "tidex_-_short_stuff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe33c07-af01-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620370841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370841, "uuid": "b05c3c00-34a6-4f0d-b00a-942a266d211b", "comment": "Malware payload (Dridex)", "value": "93fadcea66443fdcc3763c2f481eeb3e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370841, "uuid": "a6a52fa6-45b4-49f9-b936-1a7a5dc99178", "comment": "Malware payload (Dridex)", "value": "314365e88a0371eb3c124b71f5c888bb4eebc1ec9a72c76db826a8ee017100e4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370841, "uuid": "dd2f2847-8d04-407f-8349-e9c171257a6a", "comment": "Malware payload (Dridex)", "value": "f91daf659d1eec861782eac852ae5d96b01b4ecb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370841, "uuid": "19a04d99-4d69-4de8-9ab2-219a69770ece", "comment": "Malware payload (Dridex)", "value": "83366524ac01cec0509195f3388db4172a58a7da23bfd07283633e2623d7916dd4aa7ce64678b4cb617c5690bd6eaf49", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370841, "uuid": "518cb872-dddb-4cdb-addf-76c43753361a", "value": "4DF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370841, "uuid": "868d6b46-e9a6-47b2-8817-1c1450af4ef4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370841, "uuid": "981c82a2-27bf-4ae4-8745-047fa3b82f69", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620370841, "uuid": "20be8c45-b0be-4747-ae00-c22535c3c178", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620370841, "uuid": "8c0dc134-83e3-47b5-b44e-b8c7840124f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370841, "uuid": "87e0fd0b-930a-4d05-a5a3-6c681c17fea7", "value": "93fadcea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8422966-af47-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620400840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400840, "uuid": "3d20fc5f-0847-4dc1-a17a-f89013084795", "comment": "Malware payload (Dridex)", "value": "06930da3673fcc80ffe15f003dcda6eb", "object_relation": "md5", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400840, "uuid": "38aa794d-c9d0-4b5c-a4d0-2841277b5cba", "comment": "Malware payload (Dridex)", "value": "316bfe024dc25e21df637ae94bb55709764377f1d17c4169132f6de7fb19b259", "object_relation": "sha256", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400840, "uuid": "ca136a19-d2d7-4188-8d34-6e45fd347a05", "comment": "Malware payload (Dridex)", "value": "50a80c69f7c1af340274c30130f5cb264ec64b2e", "object_relation": "sha1", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400840, "uuid": "c747dd13-abc7-45e9-a2d0-6d5a96d6230c", "comment": "Malware payload (Dridex)", "value": "6a8f80c4b0a01b191336fde7a2ebfb67948f327c2940a7f7c847bdd6db2764b5bca6e3e686c4eaee14a7b7208cc3a2df", "object_relation": "sha3-384", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400840, "uuid": "47e474b3-6276-47c2-b909-f155157f0da2", "value": "4A24129AD9E6EA1BCFA7243642D56FA36667506192F3BC1CB509F73CF244E02A4C10C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400840, "uuid": "12a40137-141f-400a-b081-981677044bd3", "value": "6144:5X/oYUIO+/ENhLv5xyGBVeJZnC469axilrxDw:5X/oYUn+crRBjeJZ369KYrxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620400840, "uuid": "114947ed-37bb-4064-bdb0-99e19dee4ccd", "value": 223799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620400840, "uuid": "2e920ae1-bf78-46a9-9541-c0e50c4a445f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400840, "uuid": "792812cd-0238-4884-aee4-2c4a74f868e8", "value": "scan of purchase order 6703.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4d0821-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620392468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392468, "uuid": "4a58aeba-4df5-4153-af2d-fdb65385f296", "comment": "Malware payload (Dridex)", "value": "1d1d564ed7cda8e1e9b20ddde75f474f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392468, "uuid": "e10a5894-93a4-47a8-9a43-580e181ca20f", "comment": "Malware payload (Dridex)", "value": "31d7afa8900de4114d4cd0db1ac437aa44b4fd67c430b287a3fa87eb447dbbfd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392468, "uuid": "912a1b0e-e918-4b00-82a3-a6512d581fe1", "comment": "Malware payload (Dridex)", "value": "7a1323c6598164f0576d2d993738e7e977093e31", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392468, "uuid": "58aa0fc3-c9ca-4c92-90c4-6a92fa069f8f", "comment": "Malware payload (Dridex)", "value": "0cad9a3432f927bab14c600d1d3075b841faa39ed6a37c488ec82c183ae2f1f794d49d28bbb7aa9c5d57b9d6220c695d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392468, "uuid": "fed56a4a-fa6b-48f4-bc9f-0ac98d02258c", "value": "37F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392468, "uuid": "d4fff736-9669-4ec6-b1e8-8baf417b5bc6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392468, "uuid": "f163e028-0361-4d0d-851c-e166c47d3713", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392468, "uuid": "ea81c265-264a-4695-8978-9c63f7f76021", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392468, "uuid": "18537f3b-e053-471b-b974-026187d17c86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392468, "uuid": "d3d1fe17-f36b-4d28-94bc-03f7d434eef5", "value": "1d1d564e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6845c4d-af09-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620374262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374262, "uuid": "19288c21-ac8e-4997-a792-d784b616e756", "comment": "Malware payload (AgentTesla)", "value": "83c510f2d56dbeb23a766837945a221c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374262, "uuid": "76456f9e-d9d4-4d99-bcf8-eb7a7804268a", "comment": "Malware payload (AgentTesla)", "value": "3238cd98f0d5cb87510c0a57415f7d41087b738adf44ee4cdd04bd7b586b4db2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374262, "uuid": "bd6a7f69-8025-401f-b53d-3b86da98ab95", "comment": "Malware payload (AgentTesla)", "value": "bc8f262f202f9edad293f73023cdad2d38520d9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374262, "uuid": "dfac5aef-c72f-4c0a-97c4-f92e3c5006a8", "comment": "Malware payload (AgentTesla)", "value": "1f323e4bc5612f72b86305e10e81127f0368eba6a5c75a4425c9c24670982e700e2fbd4d5637f8804e483d78e56ff4bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374262, "uuid": "9f3f5d1e-f22b-4265-94b8-27abc479ee5c", "value": "FE05E0222385DB61D82A57B9E06013F017F2BD11F722DE1FACD43CEE7976AE10695683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374262, "uuid": "e3f12978-4396-47f4-a70a-e663481494f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374262, "uuid": "383c1105-582b-41ff-868a-26473c7f5f77", "value": "12288:ObQIML29qx7s1EF7z5CiWsgi5/Gyj7jMhK72F/n+kHyGc5Tw:ODJq1sCFz0iWa5xjMhPFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374262, "uuid": "df690913-98a8-4703-9c48-5112d5f043d2", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374262, "uuid": "9185823d-0681-4085-b99b-c71efdc2b2db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374262, "uuid": "bdf5182c-ac55-4c8c-b217-5f322934b85e", "value": "260337100 HBL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a0ee3b-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407414, "uuid": "ccec2c9c-34ad-4a0c-bb82-a3af410f6f05", "comment": "Malware payload (Dridex)", "value": "bcc2f7fdcae65982f99fd10d0929f5c1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407414, "uuid": "4464dcbf-cea8-4f42-8d89-1e6f228a7a0d", "comment": "Malware payload (Dridex)", "value": "32599b768ae591143f56f2f2a0386518672bad766f8093957b858ac9455ce009", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407414, "uuid": "5490467c-1714-48fd-9bb4-46a0048a561e", "comment": "Malware payload (Dridex)", "value": "064dc2436d35e26b32acb5b8c3574cc27a2565ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407414, "uuid": "a9bba01b-5c55-48d7-ae6a-086fcb71e4b2", "comment": "Malware payload (Dridex)", "value": "7b5aca8f6d165b23ebebb9f983059429c993236949a9efc1cb0ddb62945bf4a732706e69e464e5e84afdedd2e2b90967", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407414, "uuid": "ca1fe79e-2a2e-4afd-9a89-1400f45c356f", "value": "98F3D081E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E051A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407414, "uuid": "7a64ea66-1b97-4a46-ba34-aa68304eef53", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407414, "uuid": "9850343a-3b48-43a4-bf1e-808f82c310a7", "value": "3072:1BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHji:7uXLcclWEc2HeSjNjGdeDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407414, "uuid": "1b4ed6ab-2b13-413b-ba11-6c844d147f22", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407414, "uuid": "fafd1334-977c-4943-8a5b-1ca7fd308ab1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407414, "uuid": "5649e5ae-d8d5-481b-969b-c38ecf8dca99", "value": "bcc2f7fd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88043ac-aecf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620349301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349301, "uuid": "f82dca2a-b92f-46b7-97a1-95ff0f8b2b57", "comment": "Malware payload (Dridex)", "value": "0cca965a3df83a32e9af43bdf8ab4941", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349301, "uuid": "c809eaaa-d9cc-43f1-881d-ee89b52947c0", "comment": "Malware payload (Dridex)", "value": "327ebcb8530d991d3abe0e6cf88baf758cc7a331539534a33f6aa44226a33894", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349301, "uuid": "7762b607-720a-41fe-afaa-a02043139f8b", "comment": "Malware payload (Dridex)", "value": "a6243d8e0109abce2c4239c6e563b8e71b1696d8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349301, "uuid": "eb23c876-46de-4157-9129-dd91be14f107", "comment": "Malware payload (Dridex)", "value": "3a4488af748eea95719ef6d8de969074ee94dbff76439a9ceb0f686f35b50c9f1f92513e1699d43afd43958f02fc1424", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349301, "uuid": "c3c7b174-0a76-4ea2-a295-92d73d8b2c4f", "value": "9FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349301, "uuid": "786e9098-2740-4e41-90d4-61ff059d74fa", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349301, "uuid": "e34d097f-ddaf-4dcd-a8a2-8d86bb65a831", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620349301, "uuid": "c48ca66c-9738-44c6-929b-fd7279d5eb03", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620349301, "uuid": "4805a4a1-e35e-4a7a-9f33-d817bf140c77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349301, "uuid": "2f375fd5-cdc6-481d-8371-5496deda75db", "value": "0cca965a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25dc3722-aed8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620352893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352893, "uuid": "f5128293-7459-481d-ad09-2a67be631103", "comment": "Malware payload (Dridex)", "value": "66187692ad84638c72cc4207339e6ed5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352893, "uuid": "7a0a6c57-76a9-4164-9ef1-4ba20735184e", "comment": "Malware payload (Dridex)", "value": "32bf6b04cd9aadefb78dea27f72a10c4904fc09cd8dd0f35cf104f7163a8e3cb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352893, "uuid": "07cfe78b-0a61-4ac6-8259-e5ab0ff007a2", "comment": "Malware payload (Dridex)", "value": "e88c65ef47b15273cf2aae0a9b98c7d9fdb03805", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352893, "uuid": "3b256411-5450-4748-978b-d58212e41d97", "comment": "Malware payload (Dridex)", "value": "155a3d8198c00a8df10048efb71e5c01b07097c158ce7f5edeccf4788760e29e1c596ffb9636130d8a5bf905fc6f796e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352893, "uuid": "8673be51-5d95-4ce6-8379-2e2fe82855c6", "value": "6CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352893, "uuid": "88203912-4e85-4f71-9bb5-d3684b7e9822", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352893, "uuid": "06922c56-b7bf-4aee-96bc-911ab96d8f31", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620352893, "uuid": "608eec36-9214-4a86-8e9c-d923922df805", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620352893, "uuid": "dbb03f9d-3dca-4328-9e3a-09c91bbc77ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352893, "uuid": "df5c504a-9df9-4a26-ad7b-12c507cbc9f8", "value": "66187692_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a39910a-af5c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620409675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620409675, "uuid": "742dfdc2-3b5d-4aa1-a83e-5dc30546d181", "comment": "Malware payload", "value": "3f6dab35456f5fa498823658fd312886", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620409675, "uuid": "037bb7f3-c596-434a-a6fe-046703271f2e", "comment": "Malware payload", "value": "32db546c6a52871faa74de29128abf368a2f8c10cc7d0d22303517c2f8fcb486", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620409675, "uuid": "a4fe3c48-8efe-4e81-8398-ee1fb95422a5", "comment": "Malware payload", "value": "9ba580986ee804b3d96c74f017c1ff28c932e2d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620409675, "uuid": "e1df3468-e480-40ca-807d-d8d349ab40ba", "comment": "Malware payload", "value": "06cd66965e88b2646010afb9d8fdf6929a182a27b7d5c602d5e3070eb23b72a3e2c1105befdab7fdb29ea818b6d769d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620409675, "uuid": "758f49cc-8614-47cc-9041-91218afd4949", "value": "5C355B0DEA42DAB2E1B19132068FE77655318439C633E562EF1EBB7CB476310AE0D359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620409675, "uuid": "10fefe7c-2084-4c4d-9cdd-d1dcd7cda674", "value": "24576:5HMKV9YElym1LMY+QEG78dvJs1rH9UjlW9rTcrsECm8XQNW:5TyqL9EAqOTcrsJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620409675, "uuid": "ceb5e25b-9bc2-4b55-8d94-51d3de7508e7", "value": 1097244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620409675, "uuid": "77585896-c5a9-4643-8d56-e625963e8f71", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620409675, "uuid": "4403d943-c883-4be9-966f-50928a1544ad", "value": "sync86.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e7fb38-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404183, "uuid": "1974b270-a522-4358-8821-738ab8589e68", "comment": "Malware payload (Dridex)", "value": "4b942fd3778a23366ddc17693cceb444", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404183, "uuid": "cb0a8a37-72ac-440f-8823-cb54cd4e4e4c", "comment": "Malware payload (Dridex)", "value": "330d856b4b43843bc724ba916e5d89c0d71120606c27e9fd2cee9969db0bd132", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404183, "uuid": "0c64f83c-56cc-40ed-b26b-73f7d81c590a", "comment": "Malware payload (Dridex)", "value": "a906868dec470f81e17037eee3c1eb7a6d3c0b71", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404183, "uuid": "e114c002-b736-491b-a97a-72765662a472", "comment": "Malware payload (Dridex)", "value": "5a38a42245ade9edd7cb27bf9d465d1c87788b0dc9338b943f2ec37f02ecefe24dfa9c4ef3fa935f19357304d0c6ac4e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404183, "uuid": "eb78481f-f6cc-49ba-a414-1517c6292250", "value": "79F3D081E78ED5E0FC075B333EA80EEF52310087691854E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404183, "uuid": "ea28d4b4-17df-42ab-ab2b-4afb9c8f3e4f", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404183, "uuid": "e4c2a0fd-e4d0-4329-a431-e454440a1331", "value": "3072:xBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjr:vuXLcclWEc2HeSjNjGdeDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404183, "uuid": "2d1c30f5-be13-4c2a-b154-7b3a04fc5843", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404183, "uuid": "a8618758-68cf-4f24-a637-34715bca2391", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404183, "uuid": "44289774-44a9-4424-86d8-fc4b5500a0aa", "value": "4b942fd3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8185d7a1-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404157, "uuid": "be40a1bd-aaff-4ec6-9dc9-06cbef9642b5", "comment": "Malware payload (Dridex)", "value": "15935240be39b22a85c0d30f36f8f6ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404157, "uuid": "34d8accc-040e-4910-8c97-77a11ee9fef0", "comment": "Malware payload (Dridex)", "value": "33335fe0eea912f5ee0942f6c9b44a883fe46a2dbcad4fb3f87033bd1dcd3b65", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404157, "uuid": "a92006c9-f596-4637-84fc-f8966fdd72fc", "comment": "Malware payload (Dridex)", "value": "0c462a80ea28152ae5c4f45e285d7e8159f03334", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404157, "uuid": "29b1e08e-367e-4b2b-a1a3-a2e4bec1c7ac", "comment": "Malware payload (Dridex)", "value": "cf1b0cb92781d33f875c060a5c7d4c61e188ebae90dbf9b534260c48ef33a3a12cb78ed507b1423c64257628b2f9655a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404157, "uuid": "68f63788-24ac-4c95-a5e9-84719cd33063", "value": "2AF3D081E78ED5E0FC075B333EA80EEF52310087691854E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404157, "uuid": "5ff4b3ae-9204-49a0-aef5-309a7552c441", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404157, "uuid": "9134812b-f8f9-482c-bb0c-54aea8f4b46f", "value": "3072:EBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjr:guXLcclWEc2HeSjNjGdeDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404157, "uuid": "caff527c-1abd-407f-b7f6-1d407d1e0246", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404157, "uuid": "05a6f7b7-9434-4474-bb3f-ffdd301427aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404157, "uuid": "7a2d0649-b01d-45b1-84e0-774f51c50663", "value": "15935240_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1f15da-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403910, "uuid": "49f45d35-2828-463f-9b4e-bfca387c3874", "comment": "Malware payload (Dridex)", "value": "27cac6035bbb73ebeadbf59dabb85493", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403910, "uuid": "9512dcd5-33c4-4337-b342-b0416d0b8337", "comment": "Malware payload (Dridex)", "value": "334ed8795768e5fdcc14fdfda0eb0be35a98b687db18a18d88f59c9308125849", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403910, "uuid": "9af11993-fefd-4ee7-8800-a591b8e5e093", "comment": "Malware payload (Dridex)", "value": "ae26eb76639b206ad3ef06eff41a3451b5fdc49a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403910, "uuid": "c8c02a25-0839-4f6e-a514-e6e7b4322c0c", "comment": "Malware payload (Dridex)", "value": "1ecaf2b28e70bcb53e3cfc35a8e2c0b3db1104c9661268432c0389307729ddf27cd60b955a0ce756c2d1374d04e47017", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403910, "uuid": "e94cc282-e4f1-4071-b28a-ef643941eb33", "value": "AFF3C141C9C5CCF0CBE36C3A4695963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403910, "uuid": "065da8fd-067f-493c-89b4-4440bae29b35", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403910, "uuid": "1fcdf36b-47ba-433d-9f31-d057b6250d32", "value": "3072:TuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+0Hl:T0czbty9uiaJlhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403910, "uuid": "8b84c30e-62a0-4602-9509-5a938ea2ce1a", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403910, "uuid": "6a68852d-a695-46f2-a857-e58d074efb9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403910, "uuid": "e82f2fd6-a385-4eaf-b366-ce9ea28763af", "value": "27cac603_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c71b24c-af02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620370943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370943, "uuid": "1ca90d16-255b-4039-80ae-4fc906646bbc", "comment": "Malware payload (Dridex)", "value": "48d4ecd93915e6673e0dc9c2619ad975", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370943, "uuid": "087c1e08-3b02-42b9-a931-3f0d80942105", "comment": "Malware payload (Dridex)", "value": "33540777ceadcd8f08bb7a5a14e4706366daa78b72bae10b4c632df9657c2e36", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370943, "uuid": "2c0b3650-b142-4ee5-87e2-7c0f42602e9b", "comment": "Malware payload (Dridex)", "value": "939856618a7ce531f9b7430c1c91ed14b1692b1b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370943, "uuid": "64dc9242-bf21-4e8c-8369-eabb1c6e4f2c", "comment": "Malware payload (Dridex)", "value": "14a48306670a68fcb749ff24b7c6dc6c518facfc7ef359fced800aa7fe5e64ffaab52daad717debde35f9d7ed5413698", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370943, "uuid": "da2b08a4-93d6-43f2-9209-c0d28da361e7", "value": "7EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370943, "uuid": "1a1e2113-fb73-436c-b2e4-146ff0345fe2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370943, "uuid": "d91b36a7-69a1-4f73-9a22-5a358bc3f1de", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620370943, "uuid": "dc32ecaf-f518-47e2-813a-80d35c690b9b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620370943, "uuid": "514b1b51-a532-44de-89c0-7c49680ea51f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370943, "uuid": "5bb477b0-eacc-4c73-9fb0-9b44fcb5fd23", "value": "48d4ecd9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b4043a-af1c-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1620382439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620382439, "uuid": "1cef9708-6dad-449d-a734-66e5c2551748", "comment": "Malware payload (CobaltStrike)", "value": "60a1bfe619b2dc1cec9f3f61762255f4", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620382439, "uuid": "fafb2e1f-1138-4b24-b3f8-04119dad0b72", "comment": "Malware payload (CobaltStrike)", "value": "339c7ac759b7ef0ab8e2a9434f53fcd212786575b08b4b41687ab10fdcf2c502", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620382439, "uuid": "72af9c58-6fa8-4731-8e16-62bb6c6ca577", "comment": "Malware payload (CobaltStrike)", "value": "0c71506f28da58c9c90a0008eafae21309f729b7", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620382439, "uuid": "911c3f45-cf79-4ba7-8a98-39b302767b2b", "comment": "Malware payload (CobaltStrike)", "value": "921525fbc969d1ab13b0320e571ba71f2a594d4e7ea2ed6681c8d6cf084705c525e1578ebbebfa1aedce900349e4b4ab", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620382439, "uuid": "5e06024b-559e-4ac3-bec8-69cc369cee6c", "value": "01821A7EBA4228E9C12BD178C9E92771ADF27113417B271F2FB8C7302F21969457D909", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620382439, "uuid": "439a9920-aaca-4fad-8f87-b9d33ba60756", "value": "17b461a082950fc6332228572138b80c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620382439, "uuid": "c62cbaff-94c8-4a0f-aaf0-27bfb4a2ff7d", "value": "192:ADMAe4Ckj19RZZ6wpSfu1bKcq5uHj7khBDSeKNH41DhBUbOj6kxiY:ADMAoKz6WtKEj7aBDimtbAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620382439, "uuid": "73365eba-7fdb-4281-bbca-abda077bc147", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620382439, "uuid": "fe86aeb8-28f5-4fdd-b294-720c4136f9f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620382439, "uuid": "e72155d2-4849-495e-81a3-dc6f344ac9cb", "value": "339c7ac759b7ef0ab8e2a9434f53fcd212786575b08b4b41687ab10fdcf2c502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0c762a-af7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1620424874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424874, "uuid": "52510bc1-c158-48ea-bf0e-003e7bf0bf12", "comment": "Malware payload (CryptBot)", "value": "f724b9eb89cf8bda2bc06422b818d069", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424874, "uuid": "54cfd7fc-6325-4c88-abd8-9400c9063d6a", "comment": "Malware payload (CryptBot)", "value": "33ac62453b6354be87cf6d5232c91ab08d9b5195ae6548ac143e6cb6b20d6308", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424874, "uuid": "d4ae6816-e81f-40ea-93b8-72a47e904099", "comment": "Malware payload (CryptBot)", "value": "dc4477511d2008667763a61b2fa37fad3666dc45", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424874, "uuid": "d51b67fb-4ff8-4eab-98e5-db890fc070a9", "comment": "Malware payload (CryptBot)", "value": "05ac09d9a595e84195e13494321eb8ff694661da471e014b14611d7811c09e7db914e6561d3cba01cf43efb8d9466f67", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424874, "uuid": "45664b1d-38f9-483a-a90f-880e8ca52726", "value": "47F4F1306A81C034E5FA22F949BB626DB52D3EA19B6C50CB23D41BEE47356E4BC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424874, "uuid": "5ec9f59a-a717-4e98-8dbc-4f1e6164726f", "value": "063255465708c5d561d9303ddc23f4f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424874, "uuid": "ec11f350-27e3-4782-a722-045718af6d1f", "value": "12288:CjhOdJ/JrIEAeI4/tYjZB9UGlAZc2yAgFPjUGNc1GmJ1IhyWSEwBYi5:JH/O41wZB9vugFPjxNcFzWSEwz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620424874, "uuid": "7cef2e67-0f2f-45c9-ae44-8f56a8bfa8f6", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620424874, "uuid": "8c7e4aa2-9351-445a-9c5d-6466b747d594", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424874, "uuid": "32dedbb6-6b9d-4899-9cf6-ff6b47e382d0", "value": "33ac62453b6354be87cf6d5232c91ab08d9b5195ae654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a584d26c-af2a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1620388326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620388326, "uuid": "decfad0c-3832-4da0-8a1a-60ce77570229", "comment": "Malware payload (AveMariaRAT)", "value": "a46e5071e79ad0c6977059d8e7979b9b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620388326, "uuid": "05439712-e813-4600-87eb-dbc7cce95bec", "comment": "Malware payload (AveMariaRAT)", "value": "3416c2ee1eb4d7c1e64b7bba4e336d5de068992d0a4b09c114ba574c057c2eb7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620388326, "uuid": "ff02676c-a6bf-4d25-a00d-bf55eba78f6a", "comment": "Malware payload (AveMariaRAT)", "value": "a0991039e331052b1ec81402a932ccfb7b9a2677", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620388326, "uuid": "6389888c-f0d2-4a40-9bf4-f3cff61943c9", "comment": "Malware payload (AveMariaRAT)", "value": "c214b50493f1395280de5650a3656bf5047cd667366824e40ee63ca7b1533db955921d8146c1f3a7144376634f1d8b11", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620388326, "uuid": "3585a8af-c05f-41f6-b11f-e080a44d6f9d", "value": "92E57C607781416FD1DB5634874DFB30B3AC82B1BE7B0AB783D4A7D1AE49643902C76A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620388326, "uuid": "204fc2db-51b5-40ac-b43f-bf1c63eea899", "value": "024991cb24b9fa09c0c6c602259f4fc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620388326, "uuid": "bdbb3c9c-7e80-441b-9ffc-2c18e7b4270a", "value": "49152:+QPK/F89+J+KsZ8STmhti/vpSN24Hg6hLu6zZZ:+Qi/F8YRsZ8STmhtCvpSNG6hLu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620388326, "uuid": "30ee6de0-e4ce-4807-97d5-c4f873f96fd1", "value": 3137024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620388326, "uuid": "89bd3edc-c7e1-48ae-a0e6-45cf6c048bbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620388326, "uuid": "04cc4097-8b7f-44cc-a87b-5291b6f54b83", "value": "oder mcdq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc84586-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403693, "uuid": "a74b7601-bf67-49d3-9374-b51ad5d2e5e3", "comment": "Malware payload (Dridex)", "value": "7980668a30a19b4e119889463af71c2a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403693, "uuid": "8b60e410-60af-4ffa-a91d-e5586fecf1fb", "comment": "Malware payload (Dridex)", "value": "343806c1587a375284af8e466f7918e3374fc86b2e8192a14146343308cd7be8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403693, "uuid": "77c03827-a802-4ce1-8b8b-8f8dc319416f", "comment": "Malware payload (Dridex)", "value": "d7c56c92fd91bfbe0fa6cf72cd12aed9f5abe962", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403693, "uuid": "cbd372c2-b0dd-482a-b980-010253aaadee", "comment": "Malware payload (Dridex)", "value": "0d4b1fc5c8e6ea7d0e536e78b14ca8048d59c5b161d5c2a47f5b3f94d0fe084d60495336e601aa1183bcaf39a872da9e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403693, "uuid": "56ab7ad8-e349-4db4-b315-a026740b5729", "value": "E6F3C141C9C5CCE0CBE36C3A4795963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403693, "uuid": "b7fc4821-5986-4f64-b428-f9be3061f5b4", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403693, "uuid": "58f96a3e-83e0-4035-b540-0a975b8b0f9d", "value": "3072:QuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+24:Q0czbty9uiaJlP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403693, "uuid": "4e6429dd-d8a8-4110-9e6e-eec6e4265279", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403693, "uuid": "043be9d6-f056-43b7-9656-5486707543a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403693, "uuid": "e4fe2e41-4623-4360-818b-1d90be2267ef", "value": "7980668a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650cc5e0-af31-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620391224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620391224, "uuid": "6072fd38-436f-4d03-9558-80bacba918fc", "comment": "Malware payload (IcedID)", "value": "ec44edc07b4a918d8066e51a086a433b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620391224, "uuid": "fc1e7e1f-261e-4cf3-ab4a-2d1b8e70d8cf", "comment": "Malware payload (IcedID)", "value": "344c6aed9945a611ec6e8dba62e7c0c4a0bd8ef573acde4498ee946dc5ab0d9a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620391224, "uuid": "c2438ad8-a1d9-41bc-945b-6f1b670b9cbc", "comment": "Malware payload (IcedID)", "value": "7f502df0e3bbb3bad9ace7569c9a1fa61eb16bd2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620391224, "uuid": "6f385373-bb9d-427c-bb8e-569b0e314d74", "comment": "Malware payload (IcedID)", "value": "5fe63c82537848599f6004f7a55ea8bcde917a4ff92956e444cb5dfa2723d92f0ccd66978a5c9a8aab25304efb9347ec", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620391224, "uuid": "38ce1abd-24f9-49cb-9b74-d1619a3f119f", "value": "84347127C5ACE17DF64754F1343CEB89C544AE80AE118DD7A6C6D812AF139F123227EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620391224, "uuid": "f4929998-de0f-4e46-b4c3-d3ea3e8021e7", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620391224, "uuid": "a9c229d6-bc89-4bc7-aa95-e2b89a0d1ce4", "value": "6144:6Ax88XNHffIYjh6QRdk7fodX67o8ck+EdB7vMqRtr:d88XNHffIY4TBoJqRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620391224, "uuid": "deea45ae-e7e6-4358-b295-dc556a15c9cb", "value": 237144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620391224, "uuid": "e86adf2c-fe9b-4a5c-be56-e5ef8edbcbce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620391224, "uuid": "e1f103ce-a4d1-40f0-96fc-31d988d791cd", "value": "344c6aed9945a611ec6e8dba62e7c0c4a0bd8ef573acd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bd409d-af46-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620400250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400250, "uuid": "34b8bbdf-6856-4daf-b6fc-e74a245d82de", "comment": "Malware payload (AgentTesla)", "value": "f59f62559c04defd3ed4dd9af29c4f8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400250, "uuid": "71596401-b499-4cf8-8717-8df7fdba107e", "comment": "Malware payload (AgentTesla)", "value": "3455716f81e993173ef1e17b90f9233f70e6ce36a735ca19c40dcf816fc389ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400250, "uuid": "0f1afef3-4757-4e9f-8760-10090ba8dc79", "comment": "Malware payload (AgentTesla)", "value": "7f617ce58553dac89d27188167cf8908f2c1cdfc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400250, "uuid": "e238e1f9-73d8-43db-9582-c366817cd447", "comment": "Malware payload (AgentTesla)", "value": "eb2b9245957a9d8a01c3145fea2b6064891381cf8f9ffc44eaca344f49b5beb9af8b11c089a55bbe350a2f077929a836", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400250, "uuid": "84be92dd-5338-440b-93a5-d9d175080bee", "value": "A6C4026433A4EF94E67E6B7D00B0560013F4B5229F93E70E5EC450DE2DA6BC486A67B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400250, "uuid": "e89a521c-80a0-483d-92a2-770edfccc307", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400250, "uuid": "6bf857a8-95a4-4df6-b601-dac51c6fee6e", "value": "12288:VCKafGMWPmAlxCGrwiNLmx4aj5crgwqCj1AQTR7YnrxzmK:V4fG3Qwu4i5DOqQTcrh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620400250, "uuid": "1413057f-8d39-49f7-b2ce-bae314e60502", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620400250, "uuid": "d34bb9e9-7531-4970-bcf1-f248b378873d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400250, "uuid": "ed00cd1a-3578-490b-8ffc-b8400c1e4b91", "value": "Original BL, Invoice & Packing List.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5949e28a-af36-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620393352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393352, "uuid": "b7fae274-61b4-4bad-9bba-fc830e898670", "comment": "Malware payload (Mirai)", "value": "30b39ce4d12f1ed4bdbb8b8b78f74cf1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393352, "uuid": "07a6092d-e83e-4735-a21b-ece835df45ad", "comment": "Malware payload (Mirai)", "value": "346e73cb3c4ad13bba93fa8af20b71f4a85919396dcdf1ce4f4042953e4432e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393352, "uuid": "a720e08d-266c-491b-9faf-aa7939dcbbdb", "comment": "Malware payload (Mirai)", "value": "536d19c6934bfa54a0b2629ccb8fb8b21053f702", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393352, "uuid": "e1f1a03a-b03c-4795-929d-2ee86fc873dd", "comment": "Malware payload (Mirai)", "value": "64c6988444b6b1775ccf5a182b66f46950dc242171c390c9201e15f4b2a28231b6d2dcba48947e742d54d171af764f18", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393352, "uuid": "fc7d1dd6-44db-433f-8939-6ccd39efa516", "value": "5F331881BC919A12C9C423B7FA2E01CE372563A9E2DF7207DE216F1137CA92F0D67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393352, "uuid": "4228d5e0-4122-474d-a0a6-eb2c7db2c0d5", "value": "768:KEYhuGUGrNMi4fnhSei7zpneely6SdkwHUoO/cBNOS935AU1MU:uhuGUGeiInhSeinvBS6wHH9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393352, "uuid": "dee0cf9e-e2e4-4e44-bf30-733f2bed6e0f", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393352, "uuid": "53c5f685-ec01-4ea5-9d45-bf36f78beeb4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393352, "uuid": "d813005f-4b32-436e-9787-32da94e154be", "value": "badpackets.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e80f98f-af09-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620374060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374060, "uuid": "8cc73c0e-19d2-40d9-ac73-ebd0bb67abfb", "comment": "Malware payload", "value": "d1df7ef4a2de1c742037fe9369e9b337", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374060, "uuid": "5ee97b72-7919-480b-8584-c8d48974cff1", "comment": "Malware payload", "value": "34a1bbb30373e208bfcde2a02f61df5b3656116725e931c4d105f27f087aedab", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374060, "uuid": "56ec40fa-63eb-484c-9e7a-07cd453e6ef3", "comment": "Malware payload", "value": "70325c786d0ac1140a3b41e0dd8bc4d440603ce2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374060, "uuid": "11925d8d-1af6-43c7-950f-4fd650136891", "comment": "Malware payload", "value": "7ddff54d6716cbadee65f56d5a34e52625aa41b1a564f73ff953a14599f6d30cb73ffe0591c78a3390c10e0a1c288376", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374060, "uuid": "f1e86ea4-78ca-4f9e-ab7d-3d51fa7f3e0e", "value": "0AA3D02FADDAD1B4E10F9531042A8132E64C6398E525D63F29FD48C92D70CDDAB52ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374060, "uuid": "9f89d310-a385-4d5a-afbf-68a39fa37b79", "value": "3072:RSOH3WHMcbGMD9Ja3Ho7vbE7OswuM8h0d1x:RdwYa9JaXwbE7OeMB1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374060, "uuid": "9928d9c5-9217-4c83-b3cc-2217499d8de7", "value": 103311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374060, "uuid": "d6f9e421-7eb5-4a2c-95fd-c483ac4bae2d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374060, "uuid": "9987c461-ea75-4713-ac3d-00a5b115e48e", "value": "SKBMT_Amazon 2021 at 1_343_JPG.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da833544-aefd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620369088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369088, "uuid": "55496182-16ef-4136-b55b-7cf116cef601", "comment": "Malware payload (AgentTesla)", "value": "8b8253537a4b0194f8e47414186db6f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369088, "uuid": "50b5d8a6-a70c-4892-b554-6dd533c7fde9", "comment": "Malware payload (AgentTesla)", "value": "34aaad5b9e4f18a2cbf98161ba6674153bca70e64fa1d9a83953d2d17cbe95a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369088, "uuid": "a893e23d-591b-4311-9ee2-7b06706b4e3c", "comment": "Malware payload (AgentTesla)", "value": "e4b5ccaa66d634bf21761c6ef20508b60737dda6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369088, "uuid": "86640ec6-4065-490b-9044-895e4a33fd01", "comment": "Malware payload (AgentTesla)", "value": "0b3ee15d778ef9c7292b71531e198d4dc65f8c4fca7c9a19b4fee0c082d2caa21bcf66b42babe8f74ec1fa697ae8111e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620369088, "uuid": "1a5c6985-f1ef-4ea2-8fd0-651e84917b6f", "value": "C1E4DF2813078E5BC1BD197B84409223B2F1C66267D1F78A3FA485FA1FD67D68B193B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620369088, "uuid": "6267c3f2-93b3-42e0-a5d6-5cfa480dea1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620369088, "uuid": "2309f639-0dde-4c5e-b9d6-99425caa1842", "value": "12288:mtL1GMo91B/W5rnbQbkm7W4dn28seIHFSM5L27MeWYTl9:aG91YpvmHjBIEMAWYTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620369088, "uuid": "73788986-4b89-4c0f-a634-5bef5eb52d16", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620369088, "uuid": "e399226a-8e09-48ec-aa39-a84d658140d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620369088, "uuid": "a5711c25-ebde-4198-b8a9-e3a733f64f4f", "value": "SwiftCopy-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9628dcc1-aef9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620367255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367255, "uuid": "6149bc24-106b-4b9d-ade3-708a13591bbc", "comment": "Malware payload (Dridex)", "value": "084cbef876d2699260bf0db4c1ef98af", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367255, "uuid": "3c13cc0e-cd97-4fe7-980c-f7386ab410b4", "comment": "Malware payload (Dridex)", "value": "34b42b13e717dafe334cd351d982cc163c922328a30d29eda28d9daff0b99c17", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367255, "uuid": "8a4a6db5-f185-412c-b0b8-1d6c4a0aaa9f", "comment": "Malware payload (Dridex)", "value": "6113b7a060961c59f95d4f8b6bbddfe5aa9a3f85", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367255, "uuid": "27f38c71-0f4d-4a43-9ad4-68d168109cb0", "comment": "Malware payload (Dridex)", "value": "f27f00eb59f07dba5d4f4799e450e1f60db64d9b42ea93ba8f91a6ff8175cebfc6819d0cd2b0ac5c96b647249804b1ae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367255, "uuid": "e16ff464-fad2-4b5f-b13d-14e700a22782", "value": "52F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367255, "uuid": "96171d44-8ee6-40f1-994d-b8970b79b3da", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367255, "uuid": "65ce0bea-9a59-4d28-a01a-e7c4420b4c55", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620367255, "uuid": "1c9987cc-4216-477c-9c19-52b8771688ce", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620367255, "uuid": "b63145fd-f550-431e-9e85-272024088a14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367255, "uuid": "b03a3175-5a5a-42e2-bef6-2f09f2987146", "value": "084cbef8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ffdb80-af5e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620410548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410548, "uuid": "9fef84e8-0a41-40a4-8b16-1a8d89fd4ce0", "comment": "Malware payload (Dridex)", "value": "835a296db3ba1b3ff042126599527025", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410548, "uuid": "15e5b250-6da8-409f-be65-a0c93df828e4", "comment": "Malware payload (Dridex)", "value": "34b4ddd8b9a41343b3eb332cd6a02149af6d8e43a7a410e8557d0882686f3836", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410548, "uuid": "5dfe41f4-158d-4af0-8f3d-be72ae06462b", "comment": "Malware payload (Dridex)", "value": "88e8f0c8bbe7bb7fabb2e50e15bbb00c89c66cb8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410548, "uuid": "2ffd132d-ed7c-4977-82bf-0b3f9242a260", "comment": "Malware payload (Dridex)", "value": "61e92055bac4742c0ab5d8b7c97a357896f0c414f723703a237e9aec331f76006f2ab2118b319fe14019bf382ec68296", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410548, "uuid": "da704dc3-69c9-4de0-9f00-994a316d5c47", "value": "67F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410548, "uuid": "1ab255eb-7c8d-4efa-8121-68e84f4fc8ee", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410548, "uuid": "69e0d061-af4d-4c82-a13c-60696d4ab1cc", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620410548, "uuid": "f6042ad2-6a2d-4760-94d5-369f0277089e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620410548, "uuid": "a48cf8fe-872d-4693-8fb1-202161469522", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410548, "uuid": "7aafc66b-f7a5-44ff-ac2a-347e50daa4a7", "value": "835a296d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93af747b-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404187, "uuid": "a7a89843-abe0-431c-8cf7-54ef2d112c6d", "comment": "Malware payload (Dridex)", "value": "72b342e28e76e00a5c6a67ea8d26e298", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404187, "uuid": "9cc39e0d-6456-45ec-aa58-2cfa2fd7e65d", "comment": "Malware payload (Dridex)", "value": "34b721828372f920daa8023e4dfbd1cd43ea3ecfb3d02439966281080f880b68", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404187, "uuid": "bffb5db6-e4e8-4687-91da-bcf76accb70b", "comment": "Malware payload (Dridex)", "value": "3f056f34bca6401fee11aa24a7f207c26041ecc3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404187, "uuid": "b53f8a52-f2c0-43ab-b142-8f9f12e9c928", "comment": "Malware payload (Dridex)", "value": "719dcb7f316447b3daa9b4e2b0c83d2c6b1582bfc7f83cc7b60d6703abbbfad84e2c3e1111dd0464205b2376b0c03f0d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404187, "uuid": "b6522ae1-fcad-40a2-9477-7f4ddb3c7e86", "value": "B5F3D081E78ED5E0FC075B333EA80EEF52310087691854E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404187, "uuid": "fad8c102-2dce-45f0-9fed-23f972988982", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404187, "uuid": "13ca20eb-b605-4882-992f-fedb313574aa", "value": "3072:2BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjr:OuXLcclWEc2HeSjNjGdeDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404187, "uuid": "d06c61e2-3dfd-41a8-a6bf-235689579b74", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404187, "uuid": "2740cb50-a71f-40c4-abf8-28198aeeac3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404187, "uuid": "e3410470-5b98-4cb8-972d-6dd1d1211732", "value": "72b342e2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a114d5-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620406982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620406982, "uuid": "a2004536-f8fe-4854-9b05-521ba83ec572", "comment": "Malware payload (Dridex)", "value": "acb14d18f41b319293799cda0d002167", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620406982, "uuid": "ec202476-00e0-4e2c-9a1a-9fdbd89df171", "comment": "Malware payload (Dridex)", "value": "35161aac7251821d020866340401b68a27a8ae4c4a116d4d20d90bc2dc2752cc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620406982, "uuid": "65d0f505-efcc-4ac8-b912-d02c8e95fe75", "comment": "Malware payload (Dridex)", "value": "3fc603f5f1dcc257ecbc7ad958b2d4f0c4cf8828", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620406982, "uuid": "1e236500-b58b-43c7-8b43-59b70724e286", "comment": "Malware payload (Dridex)", "value": "ab07ed5f8d4e9909a918f5d7a1ed8c1015434c0c913ad87575b26c4e04bcc6171ee6d76f57259a1dfe319ca44ebbc9dd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620406982, "uuid": "0189af34-2843-48aa-8d8f-68e2463555e9", "value": "A0F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620406982, "uuid": "446e2e7e-0f88-4a06-a184-7671a302953d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620406982, "uuid": "ec980ec2-d22c-45f6-bc4c-bda46519f0e7", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620406982, "uuid": "20b4fc39-254a-41e4-809c-e0a84b8552b8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620406982, "uuid": "f243b667-8a1a-4d28-8477-aa4a55a85e14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620406982, "uuid": "a0ca4730-3c52-4e50-a387-a6151cf73243", "value": "acb14d18_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1294f4a-af2b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620388829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620388829, "uuid": "bdcc07fc-90f9-4828-b190-b0f85aaaa7bd", "comment": "Malware payload (IcedID)", "value": "e6cd3ba39aeb24752ed6370ce08d1411", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620388829, "uuid": "a8ed6a1f-130a-4199-9200-186c2e396298", "comment": "Malware payload (IcedID)", "value": "352fbf0bc54cdd36e9241b632267002e0cb9568505e9ec31e8aeb0af7b5d7fb4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620388829, "uuid": "0c00a2a4-7264-45a2-9752-2cd6afad8bf7", "comment": "Malware payload (IcedID)", "value": "7d97f7362f8927b7dccdea6dc6b116deb2692ce5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620388829, "uuid": "d08f1d79-134f-4b20-aae6-cae7f5dc3dd8", "comment": "Malware payload (IcedID)", "value": "ee75926d59166b930992172b2df63eab996718d8b8f91abf583e5c0348caf286a410086f86d1ec7842b5a19af013cdcc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620388829, "uuid": "d3a8cb20-547e-4fe9-b939-b81645fc08b2", "value": "D4349226C9E8D17DF147A4B6743CDB88C554AE809E218DE7A6D6C812BF138B117227CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620388829, "uuid": "933bb776-efd6-46ad-b10f-ef466c692af1", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620388829, "uuid": "dcac572a-1ed1-440f-a9aa-2835ec1fc867", "value": "3072:/Z+jEoUhhUuTjmhkJU8XV+eDOWedYlGRWMxAeiAbO+yH5wtrPPPPkeU/hLzQHaOU:HlmE9rfwZSueOI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620388829, "uuid": "e208c42a-196d-4f6b-a256-7d8d1d48f92c", "value": 244312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620388829, "uuid": "2b6c5cfb-0f62-4a3d-a77d-f4ad920cd922", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620388829, "uuid": "7dd0a47a-fd41-425c-a846-b0aa01975d12", "value": "352fbf0bc54cdd36e9241b632267002e0cb9568505e9e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4dff5d-af35-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620393008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393008, "uuid": "03005228-ac5e-4213-901b-910c711ae9d8", "comment": "Malware payload", "value": "a6ec35441042ec37a0815e6e2af66457", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393008, "uuid": "45d13012-c469-4526-96c4-65122e297db9", "comment": "Malware payload", "value": "355fc214789296e7aa585b91eb87ba96291e8dfb625c95e4209a6534ea790937", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393008, "uuid": "037237ed-729d-47a3-a802-93bdc5b29576", "comment": "Malware payload", "value": "1e9ff079c576b0a4b28adeb83f07496a73582038", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393008, "uuid": "32d3689b-8c60-4c65-9308-068559d2a0af", "comment": "Malware payload", "value": "06b673f2889b0cbc857db66b8c5c0b3eb99dbec9b99d05ba86df015319702e91da52fa2e04a86976dc6a1aa84d16ad56", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393008, "uuid": "98df07b6-e745-4c83-b703-bac684725e63", "value": "9083404D6E214FBCFFAC453447B39B21964933DA36A1C688D5DCE9026E7034A342FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393008, "uuid": "16c4c653-b0f2-4a32-927a-43421d1e60c6", "value": "1536:d1TA4XRyABsklfWNUTpW2B+kAPn8/Ya/2BL:HM4XRyAKCWNU1B+kAPn8/YaeBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393008, "uuid": "78f79b03-5ebe-49ae-88e1-9a2e3f21d44a", "value": 84524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393008, "uuid": "062e8168-1da3-4421-962f-b077c9acfb15", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393008, "uuid": "f1158294-bff1-44c2-aed6-b721c65c0ba3", "value": "94VG.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e12b0cfd-af5b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620409471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620409471, "uuid": "883c7618-1e72-4924-9c6a-58eeb19df78e", "comment": "Malware payload", "value": "e0f40ef0e588f4db754b9631eef0c984", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620409471, "uuid": "65e5c449-192f-4ab0-a2ee-16c2c4680a8a", "comment": "Malware payload", "value": "35781f59dd0d4db4313b493ba0f80606f0f999c904e72a2dd76b0cb111678cde", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620409471, "uuid": "92ff8470-b0e7-461b-8bcf-f144fb3634f6", "comment": "Malware payload", "value": "7d47d49a67c4e091086797e6f4f72380aba7e3b2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620409471, "uuid": "6fac57a2-9dd7-48b4-905c-8f278f5bbe48", "comment": "Malware payload", "value": "e4937a0eb9ab4f37677546f492e354333909ae0a359b5ce0b811c33df60f292b693a6a5becc212ca73684587b8caca95", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620409471, "uuid": "383a35dd-4b05-4eb8-a955-2ab0766678bd", "value": "2C05F0122384CB60D43A5779E0A023F013E2BD01F762DE5BACD57DAD7973ED146A5A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620409471, "uuid": "3292ec83-2fa9-4574-a861-33d7c9fe6ff4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620409471, "uuid": "23701cb7-1853-4dd7-8c29-3a03ae7b8d31", "value": "12288:Qvv0y9RZ20ws6ehgsuaDU9eCzjtRVQNwXLCmk5Bi2V5y54aJ11MxfIYH6N/o6EM:QznZjwnehgsHczpRVQNwmmEF/ne+oFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620409471, "uuid": "df8a88bb-3410-4ecf-b9df-b36f39346f04", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620409471, "uuid": "04047cfe-0fd5-4b6f-bddf-50dcd887ff9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620409471, "uuid": "1694fa24-7efc-4e58-b672-a1e7f97b2ca2", "value": "PO0038176 Organoasia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26759f6f-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404004, "uuid": "3ec684c2-6980-44c8-bc4d-a16c355c8f54", "comment": "Malware payload (Dridex)", "value": "2e2a5e1f6f47ab572749e27b6fd21c40", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404004, "uuid": "972f3b31-1a2d-4a2c-ac38-01bd83029e71", "comment": "Malware payload (Dridex)", "value": "35ef6e6ac58679105f4b7ce4e043c1659742376f79380acb490a8f7a10d99755", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404004, "uuid": "54ee759e-1a78-42b7-bf20-7082929c8eda", "comment": "Malware payload (Dridex)", "value": "8689665bb8c7d6abd789a212e6a309c71011f0bd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404004, "uuid": "97c8735f-3f8f-4699-976e-aba86d86b2d5", "comment": "Malware payload (Dridex)", "value": "b131605e84220f43cd31ef87c3c254a300d03c024c63eb0d687a51a594c892d4bad62e05ba53992512a1d76a3b7df805", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404004, "uuid": "0585563c-41c3-473d-836a-e4ef8ad52153", "value": "5EF3C141C9C5CCF0CBE36C364695963B3628B941995A8E42EC24CE3F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404004, "uuid": "2b3d18bb-b914-417c-a293-448559efc592", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404004, "uuid": "9136b961-c22a-4f8f-b49c-a65232c224d5", "value": "3072:uuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+3n:u0czbty9uiaJlWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404004, "uuid": "6c0a3f39-1d05-4437-b2b4-e055ec99f826", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404004, "uuid": "11f71263-c604-45de-a201-ab217bb86c46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404004, "uuid": "5645b3f3-43e6-4555-b0cb-fa0f47e27ca9", "value": "2e2a5e1f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a719252-af3a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620395018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620395018, "uuid": "4744232a-145a-4fdb-a7ad-a2174cd5fc96", "comment": "Malware payload (Mirai)", "value": "8104b0a0cc7ba0e72ab9ba01f322ebf9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620395018, "uuid": "9682565a-357e-4528-bcd1-d3c20fe5d836", "comment": "Malware payload (Mirai)", "value": "360e4a791f65c8780280fa94f001535b5c4ee214317182a42299726ff28eeeae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620395018, "uuid": "f0df9956-5c73-4b12-b34a-63e00c089764", "comment": "Malware payload (Mirai)", "value": "295e1e5834fd3a9f9b070e821a6cc0bdbbc69261", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620395018, "uuid": "5aa9ee2f-5038-4560-856c-ab1469c17bcb", "comment": "Malware payload (Mirai)", "value": "4cb4811bbd739d52213e98b213392e7ca778f8965d766477902e370a8a7249c9acd2f53d7694db8783f04a9b3f78a8ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620395018, "uuid": "7d0929b0-9e74-4249-8378-ac9021800dd4", "value": "CF2308C27941B639C3D0577BEEAF014E3354A7D8D1DA3397C8280B907A8A90F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620395018, "uuid": "3d91baae-154f-4505-95b5-55f19abd97b1", "value": "768:sJeKpHsmyayL1ScT+GRvFES1un1wnjvsDoCerCw7sC/vnX+6k7wCVy/rCxHghW1U:sYFmSJScT4MjvR7sCnnXPfhWt59se8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620395018, "uuid": "1de3f781-afbd-4192-b1cd-a275ab5357b8", "value": 49140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620395018, "uuid": "9815029f-c36a-4ebd-ab23-52fb27a54b42", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620395018, "uuid": "6163c9fd-6d38-4deb-a013-8b6adbf9ab2d", "value": "Josho.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4092e35-aecf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620349293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349293, "uuid": "e1447784-bd1c-40bc-8782-c7dc5e9eff09", "comment": "Malware payload (Dridex)", "value": "060fe88d97699536d93b69ab2fc35d5a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349293, "uuid": "9dd9ecd5-e98a-41f9-9228-8b1f6cd74741", "comment": "Malware payload (Dridex)", "value": "366f96913b305ce191a5b7758bfe6e6187a30dee7f1ec2adb1cd5a1bb40f2968", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349293, "uuid": "32f846e3-23b2-49b6-b9c0-365324baa574", "comment": "Malware payload (Dridex)", "value": "600c1cbdbe69c31567f638514bcc32bd0125173d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349293, "uuid": "600f025b-af0f-4c21-be60-a209e542c8ad", "comment": "Malware payload (Dridex)", "value": "c2b1a0b54a1375d1fa2743760dc9552e8a45fa619ff7ef0f95d6472239469f5e5cfe424b79427e19b4a25cef66796508", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349293, "uuid": "024d63b8-b135-40f1-abf6-664084cfb9d8", "value": "1DF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349293, "uuid": "8e5a00e1-f56b-4ed1-9111-5aef5dc12ab8", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349293, "uuid": "995f6d22-eec8-490f-9991-4276671d89b9", "value": "3072:wA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:w3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620349293, "uuid": "ce810b4a-3150-47af-a0b0-df05d581d1a5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620349293, "uuid": "8aef63e9-19d6-4747-ad96-b3692334ffc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349293, "uuid": "9755566d-d9d2-4d4a-90c5-e89da5ad7664", "value": "060fe88d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8abcd606-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404172, "uuid": "f7bb517a-ca18-4d22-a2fe-f1b75083e2e6", "comment": "Malware payload (Dridex)", "value": "d15b6577cd59bb9461115c510659eb1b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404172, "uuid": "a30862c0-87c5-40b3-bb82-c22b195651f9", "comment": "Malware payload (Dridex)", "value": "36c4aea5009f43be8cc709f62bc6212e248bb73b9f04760771b13f2d5102aede", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404172, "uuid": "67f76ba9-67ea-415f-b9ed-500883ca963d", "comment": "Malware payload (Dridex)", "value": "96131f563316966e53358ec1cc73d56c9226eb9b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404172, "uuid": "f3bbd1b9-d3d2-4521-84f3-abc812aee9d9", "comment": "Malware payload (Dridex)", "value": "9eccaf76b69aedd1600ee6716a82322260a662769001b94074ff3bcfb87050ad293e18b0aef19bce2226f41acd21df9d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404172, "uuid": "c9ddff29-9017-4c2c-9134-873982e5c74e", "value": "46F3D081E78ED5E0FC075B333EA80EEF52310087691854E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404172, "uuid": "4182db7f-e112-46e1-984d-d2ed045b37ba", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404172, "uuid": "56292255-59ff-4ea2-bf24-e9e59b478124", "value": "3072:jBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjr:1uXLcclWEc2HeSjNjGdeDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404172, "uuid": "2e69f0ca-0b1e-4154-84e1-c3d7b55ccea2", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404172, "uuid": "1eb2776c-3b4d-4585-a737-435b516d04b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404172, "uuid": "3154ddea-61dc-4ad9-a900-f1bf7601052a", "value": "d15b6577_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73f4a58-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403898, "uuid": "8e560a76-2264-4186-bf0f-2a85b2607ca3", "comment": "Malware payload (Dridex)", "value": "3f464f8b2eb66138c96c3078d16ea284", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403898, "uuid": "18bacde9-fe67-4d52-8f4f-d347b09f0a1f", "comment": "Malware payload (Dridex)", "value": "36e44669237cfefce6e0df796a62cba0ca9d095e1cc8d898f14cb473bca26604", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403898, "uuid": "ff7de522-7a3d-4e1f-b1f1-6175572bae08", "comment": "Malware payload (Dridex)", "value": "7d2e833f7ba7adf3db9c44f0219ebddd17d9827f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403898, "uuid": "8822f058-207f-4bb3-9767-d2417f76d024", "comment": "Malware payload (Dridex)", "value": "288ec2706392208dc129c0a39be9393485ef01f83f0f0c191322a2c2fbbed2649450583026edd2bf965fe6b79646b5b8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403898, "uuid": "5e451859-7e32-441f-a430-8fef23d0a375", "value": "4DF3D080E7CED5E0FC079B333E680EEF52310087691954E4EF29DABD96BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403898, "uuid": "724f82fa-11b2-4290-bfff-d723b3c86aef", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403898, "uuid": "fb7b5a20-f66e-4972-8166-865d2da0d2ea", "value": "3072:bBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHS4:duXLcclWEc2HeSjNjGdey4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403898, "uuid": "a3d03d23-50da-4b29-bf17-da58c17af7f7", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403898, "uuid": "3718ca39-8db4-40aa-b8cd-e90ce14600b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403898, "uuid": "16b5dedb-0cff-4eee-bd26-a7e5d4230dae", "value": "3f464f8b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a4b162-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392219, "uuid": "164e1293-7da0-464c-a93a-5f3bdd40f44b", "comment": "Malware payload", "value": "ae08ea51f279ecd555c158a3c5deebe4", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392219, "uuid": "7a67dce2-77a6-4c82-a3b8-f81b003bba7f", "comment": "Malware payload", "value": "3719ec5f8c6a388ad28ca6416afcdf2cce628e66e1b08defa76a4ae4a335b121", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392219, "uuid": "42b502c3-bb16-4850-851b-88f104c09c93", "comment": "Malware payload", "value": "cb37b08cd06a08fd6e696572f6ee8603785ef92c", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392219, "uuid": "303eaba6-9592-4429-aac2-257a675373fc", "comment": "Malware payload", "value": "6177b005de4365b3100a1941ca07703c2ed9cd4ab8953adf5355deb9b54ed296ed8e9870da756b05ee715bd6ce2b663c", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392219, "uuid": "6622c577-16aa-4e46-92fe-97c00fb75853", "value": "7B26330834C029C5E6D89A1B3F4C5D359836AFCA066464E39AEBCFE8500FED975929F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392219, "uuid": "58f99630-8367-41a7-b6db-73a8fa51333a", "value": "98304:a1wwAjzIQOMK2GNKsl8ITCWsG6dUk+WB1s6u0mVehICdH2:a1wwAYBr21I8Ndi31VoDd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392219, "uuid": "689c7bd6-d6c4-4a64-9eb6-0223e2875424", "value": 4452352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392219, "uuid": "879b31f7-304d-4cb9-9b09-f7da6e7d62b8", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392219, "uuid": "1ee98f20-7266-41d5-97a4-0d067e95557f", "value": "3719ec5f8c6a388ad28ca6416afcdf2cce628e66e1b08defa76a4ae4a335b121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1667d278-af3e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620396676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396676, "uuid": "63158894-24a5-4f49-8049-f8e7c0265db1", "comment": "Malware payload", "value": "88515ecc9d775f704a2d4d5d3ad75737", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396676, "uuid": "48495da5-9d50-4827-b0a2-235f9bfc4467", "comment": "Malware payload", "value": "371d4a17bb3641543c4df23a7acaf4b7a5d6729a87f3edf50a15f21041413aec", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396676, "uuid": "774d90cd-1d60-4e4d-a606-0b5f44f468b5", "comment": "Malware payload", "value": "3f699833c006e101f9f530addf355fae872d740d", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396676, "uuid": "240ad28c-432f-4d4b-b47a-4583da0d8539", "comment": "Malware payload", "value": "fad018aaf36c61fc63eacfd2a9d268d9264f885112e27790698d56cc79cee6fda5d7fc0225dabb8890061e1577c14a27", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396676, "uuid": "b5584034-0d6c-410f-bbb0-cda2606d4ee3", "value": "5E642349B1E37456D4BF1AA112721A485B9E96E1D0FC42FF93CC18ED01B1BBE33423A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396676, "uuid": "ef7af4ed-a2e9-42c1-a124-0a9d526dc402", "value": "6144:IL8BhwX2k9zTXFZMJoFyUSYOoHGjXsuHlRa0mTbQYBN27e8tmxnpyChlPRnKPr:IV19zIoFyUS1omjXhObEq88Lhnnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620396676, "uuid": "d021f934-4e0a-4ca4-87eb-2bc9f07a649e", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620396676, "uuid": "22cc5476-debd-48d1-bc4a-27aeb4025701", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396676, "uuid": "83929f56-3819-4e14-9546-6d8f30ebbbf0", "value": "371d4a17bb3641543c4df23a7acaf4b7a5d6729a87f3edf50a15f21041413aec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77daee1-aeef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620363096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363096, "uuid": "7637c203-5e19-4f2f-8589-80947aba6341", "comment": "Malware payload", "value": "f978cac45dfd04ded9c301c492d45c69", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363096, "uuid": "6388e2b9-8cc6-4613-840a-050278a3ba8b", "comment": "Malware payload", "value": "372a5b41afc06f25c0c2a27b4bb1a362f4fb9772deb9ad996a7dfe4ad7bd96e3", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363096, "uuid": "e6e2c33f-a114-431b-90fd-0a5839c10e80", "comment": "Malware payload", "value": "63d3e614f29874274a2ee1434e4ec4a13b0a8ae2", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363096, "uuid": "bd46a518-e329-43dc-b0b5-fc394af1cfd7", "comment": "Malware payload", "value": "17e88d616b95f2279ff1d8e49b82f36f3062a035c179eb49742d1c788bf17f4aa74b775bb6d791eeb20cc08af666e347", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363096, "uuid": "4db99e87-a952-4af6-b227-fdfa5016a89b", "value": "7B1633A8344E3FF5C18B46F3469261EFA3AC44B3D74A60C379AB993E5D1A6C44E2E144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363096, "uuid": "6106f3de-3c1f-4720-9e08-faed1e36f62f", "value": "98304:x9l7KSKIW9Q44lYPTYIbtUDjRgimiiIQqqL0k+krr7:5KSK4MUIbivRsJvPrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620363096, "uuid": "db31b41c-8fa1-4007-bee0-ec52597fca80", "value": 4086046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620363096, "uuid": "b0d63160-cfcd-417f-9a61-6a150677fc4b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363096, "uuid": "a6e93628-1434-42ca-b118-379e132cd3cb", "value": "Documento.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281d2476-aed1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620349890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349890, "uuid": "434aeefb-92a7-496f-928d-67b0d3de1727", "comment": "Malware payload (Loki)", "value": "3833e13dc10b2fefbc5319dab8d933af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349890, "uuid": "5c5f9094-5d62-4d50-8f4a-cf55cfcbf256", "comment": "Malware payload (Loki)", "value": "376cfcc18b8776d186536fc4419c84ac257fc305b4d5bcf2b73708c8682d289c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349890, "uuid": "e5d85b26-429f-45ef-9212-6be208061442", "comment": "Malware payload (Loki)", "value": "682c630328c9c506961cb2eb699aed882b61296d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349890, "uuid": "e9080bd5-8083-498a-bbc9-7b603b54336f", "comment": "Malware payload (Loki)", "value": "9d5156406aa43a15b3d0143cc50eced4343aadfe8de5f500b894a4197d580b03060d85e9914bc1f5ec7680e17388314d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349890, "uuid": "e8f642e5-a080-4036-adcd-cda88e30eeef", "value": "40749D2A7E09C03ED454C8BCD63D82927D56C29B50ACFACDD1D544ACB0127D7BA2EA3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349890, "uuid": "016daa06-e0cb-468e-ab5f-2c92d0c76c94", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349890, "uuid": "91e40b31-d40a-46f4-93bb-3f9a0e272221", "value": "3072:Vf1BDZ0kVB67Duw9AMcVb8vYyhq/EGXQvQuNNaHUbhByGoiBL07:V9X0GxasEnvLNa0buwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620349890, "uuid": "23099343-dd78-4421-bf39-99bdee73c384", "value": 366254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620349890, "uuid": "8955e647-3686-42aa-b44c-b323c0b067b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349890, "uuid": "42aad139-dd82-4c04-8bd7-5f0c0467f979", "value": "NLSGD1540208306-05-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4696978-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403893, "uuid": "e0bf3385-2e18-4950-9bbb-071066cce2fc", "comment": "Malware payload (Dridex)", "value": "defdd7d0e92c7f06e36aeb108e5cfa29", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403893, "uuid": "571f943a-6f9a-4bf5-82af-2d805ee9aa5a", "comment": "Malware payload (Dridex)", "value": "37b262d819f1e4911a6b639d44e23daa22d2947ff16d8607a17fd45d338c20b3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403893, "uuid": "0c02a356-f16f-4e07-93af-28c3aeff1019", "comment": "Malware payload (Dridex)", "value": "a0d497976071efa9363e5a799ac76282d3e318df", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403893, "uuid": "aa4c7496-d434-44a8-acdc-cde75b777754", "comment": "Malware payload (Dridex)", "value": "139fbe0c785fbe6e119b6da037339d544f70464089b0a6d9895a63c57a28d7cc274220966c326ae8b031c3a763cba3c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403893, "uuid": "618b3266-a7cf-423a-8ece-d25a8b6d1940", "value": "D3F3C141C9C5CCF0CBE36C3A4695963B3628B941995A8E42EC24CE3F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403893, "uuid": "414cf8f4-e915-4ac4-bd0c-ee251b91c6f4", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403893, "uuid": "554bfa4c-c63f-4517-8055-5f02c7e7270e", "value": "3072:MuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+3n:M0czbty9uiaJlWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403893, "uuid": "b1d1064c-a803-4334-abc2-ff50a1f1709b", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403893, "uuid": "5f22dc21-18bf-4461-93ab-d3c96abb51bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403893, "uuid": "63e5ff14-2f61-4463-a446-061fe42bd66a", "value": "defdd7d0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8bc421-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407080, "uuid": "b86a3c27-ca6c-49a1-9541-44e60a01ad20", "comment": "Malware payload (Dridex)", "value": "1fb130fc60d44cfff65334d075e7fdce", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407080, "uuid": "c17fe548-e098-4c5f-8210-c2db81b5a240", "comment": "Malware payload (Dridex)", "value": "381016ccbe20125d9f2061503f881950e432f338ba420aef8666cccf436570dd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407080, "uuid": "645e8c6d-2179-49c5-947b-e0136869e254", "comment": "Malware payload (Dridex)", "value": "6a0222b53215efd37e53633024219b82b3872074", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407080, "uuid": "86466693-09cf-4e0e-82b0-44dce8eb9f0a", "comment": "Malware payload (Dridex)", "value": "ee635636953cf699db6921c8e692eefdd99a9de77edee00e919c8bd65dc3da1a3970962743a9a57b72dd35c037a65406", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407080, "uuid": "097756bd-ca1d-4dac-8116-b37a097e5430", "value": "10F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407080, "uuid": "fabc7321-66d2-42a9-8ccc-ce385b1afbd9", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407080, "uuid": "e6fe9c61-cfa7-4246-b4e0-c64f31f19557", "value": "3072:vBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:5uXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407080, "uuid": "7eaeb76e-9bdf-4e7c-ac90-712a2b03252f", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407080, "uuid": "5705c258-a4be-46bb-a65d-09ee5dfc5e46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407080, "uuid": "ca244302-45e6-4307-93c8-75828e2fb34e", "value": "1fb130fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceba26db-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404287, "uuid": "682f1dc3-2447-4e7a-a4ff-060970dfed1a", "comment": "Malware payload (Dridex)", "value": "1fbb9db900d9d593669d1c7d23fa8cab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404287, "uuid": "ee018d44-3597-4367-aedd-39fbbba722ea", "comment": "Malware payload (Dridex)", "value": "381ad1338aa2ceb73716a1bbb0b74a3c0df3e33d2bad4fcb7758eda9e9a513c2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404287, "uuid": "6587d660-7d6c-4151-8aee-e97ca20df4cc", "comment": "Malware payload (Dridex)", "value": "7cb115561473b1388a518d7da339d98fa16f6a02", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404287, "uuid": "cface0ed-1cfb-458b-a0a4-7067a8e3f2e5", "comment": "Malware payload (Dridex)", "value": "84197a45d5055cd2035bf5274db93cd21b50d209d3b1b52b1923ce4a8699bc680ea23aa8e6b0f07c4b95b6dd83af7f20", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404287, "uuid": "74e4d915-7a2d-4b80-840d-9a788f859583", "value": "7BF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404287, "uuid": "be77c386-0ae7-457d-8825-35533234dff1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404287, "uuid": "81245d66-1c66-4e51-b10a-5ae3930a99dc", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404287, "uuid": "18b12ad1-8973-423e-89b5-cf7f021ec399", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404287, "uuid": "ce05f727-027a-4253-a88f-9ee4741d7d71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404287, "uuid": "40706695-d6a7-408e-8287-3879029de5aa", "value": "1fbb9db9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b691a989-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392220, "uuid": "a4733648-f21c-4f9b-ac0f-e6276076d37d", "comment": "Malware payload", "value": "f82502e4d2f209486302afe33c2baafc", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392220, "uuid": "d5936bf3-4073-40d8-9897-5bf42d40f68a", "comment": "Malware payload", "value": "388d48e020cc282673f27595a4e1b11905f986c5428526320a6fcb431fd0ec65", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392220, "uuid": "d3d83cba-ab0f-4ae6-9b96-d801f62ed360", "comment": "Malware payload", "value": "8aad997198a54fa5a37bf26d1d6f12c25a4b91fa", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392220, "uuid": "d59e18b9-c1a5-4895-8f33-60fefbea6b0b", "comment": "Malware payload", "value": "c55762740248d741f61c702d2c2ff694a6c3d8f7ebc2b6c149e6a201ef02e4da92eb3fb1f2352ffa901e95490875ceb4", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392220, "uuid": "094c9900-61f2-44a0-86bd-c1c71e0169d5", "value": "E4A1F850112C1AB17246697AD26FFA52B80EC81B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392220, "uuid": "e6631c00-1b4d-4118-b145-beb625743c86", "value": "96:vRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:vRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392220, "uuid": "345e1f47-4180-40f7-9af3-b8f09dd8522f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392220, "uuid": "42c2ebff-c531-4ef7-9677-be100fa5f1df", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392220, "uuid": "85224f55-aaca-4f68-bc31-448334cb60d3", "value": "388d48e020cc282673f27595a4e1b11905f986c5428526320a6fcb431fd0ec65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb07bbd9-aef3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620364767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364767, "uuid": "ff8b5063-f756-4de4-a90e-607dc9a22772", "comment": "Malware payload", "value": "c5695f88d80642378828f9310536df49", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364767, "uuid": "d913aee3-ee4b-4354-b411-2c400f343f3c", "comment": "Malware payload", "value": "38cc20967d2c0a54f1c967b22bafdc20936ebb45d236f1a3ebcb24d2c48a2fb6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364767, "uuid": "b5ba065d-bce5-45d6-9390-757637112ade", "comment": "Malware payload", "value": "2c9c3398010a479a80395980c74639df00a0ada8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364767, "uuid": "fe50ec2e-4ec7-43be-92e0-304723771950", "comment": "Malware payload", "value": "cc312f2e97ceb33ff3d99504c27da3a74166bc6cbc513da6f520deb911ef7c312c26317c5259cfea026df9ed9c93136d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364767, "uuid": "f6fb0097-af16-4d89-8fc3-335c648b3704", "value": "5FF5333523FF8EF6FA8B041456BD95B614C21C4FB39C5CA293E979910A49C4B606BF32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364767, "uuid": "cab48cb4-228b-4c53-adb6-91040bff620a", "value": "98304:PcfgfkMnrNER+CQ0sWgUY/R4HlD40v/6TkQ/yQG:HQsWgUY/RG9mIQ/yQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364767, "uuid": "627875ca-9d48-485b-b9f7-af184724f6ea", "value": 3523494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364767, "uuid": "1ad164ce-a8a2-4ed7-b586-d93079380c5f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364767, "uuid": "9da96ed5-b010-4b1b-aafe-ce476ab719ab", "value": "lol.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82e5fa1-aeef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620363124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363124, "uuid": "25074e0c-3eb9-439f-a0b8-bdbdb5207c61", "comment": "Malware payload", "value": "a6a4daa74d974f2d92b35392207070ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363124, "uuid": "5e6e2e1d-3af5-4077-9b5c-6e2bdb0430b0", "comment": "Malware payload", "value": "38e1821b1289f087cfd17799a47081a368348fdef2c45dd216390269f8e52bb3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363124, "uuid": "1019db53-0ee8-43f4-a48c-04104515596b", "comment": "Malware payload", "value": "6ece78cd87fe221ec4113cad8d41bef2475408ea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363124, "uuid": "b16bc2da-03d5-4056-a9c4-603a4c181755", "comment": "Malware payload", "value": "900d54ac6aed82dd7722aa50af57e19ae6820040c664871592c237237437b1f6a926eeb57efac170937135916bbbab0e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363124, "uuid": "37367bad-d471-4e0f-96eb-674169625c22", "value": "AC841216C178EAA2E45B4C38D5E33897B474AE330A2DF2763DD45C9FD47A1A1D80C0AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363124, "uuid": "6a854b48-11ac-4f27-b9fb-a33b177c2f8a", "value": "b602426ec706e7b23572160bb5b68285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363124, "uuid": "8146027a-e7bd-43d1-916f-97b0eb406436", "value": "6144:WVYmoP2D+6u6e1t0pjWcLCWhc6bTQUzjyvmELZ/lsyw03SxOqtLOoaMVVKlFUB7G:m2Pn6uN/0BjCacrEjyvRtTGrtLLqle9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620363124, "uuid": "272cfec3-2c8c-4294-b0d9-4efee6252292", "value": 391132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620363124, "uuid": "a631973b-529a-47bf-bbe4-21c449298dbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363124, "uuid": "f0f40f69-8253-4798-9221-cb4ba7f63c06", "value": "pocketrar350sc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a701f1c9-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403361, "uuid": "ce174cdb-0f22-4df6-952a-3011bd23d85b", "comment": "Malware payload (Dridex)", "value": "07c3a46cee25ec9921bc49d2b6cae360", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403361, "uuid": "376553d1-9fa4-401b-9689-b5f7ba594d0f", "comment": "Malware payload (Dridex)", "value": "394ded7cd6afbbc92679815251339d5a86f23203b70d0c00e7c9f011a634b4b7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403361, "uuid": "7339ec59-0417-4ab7-ad5a-3c64cc18615e", "comment": "Malware payload (Dridex)", "value": "98153572fbf592854973519ed15976dd122644ef", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403361, "uuid": "d49ca8a2-444c-4432-aa69-1921664a55e5", "comment": "Malware payload (Dridex)", "value": "49bafbbbf94071d18abd39e50d3b2d83d6784cc74fb862334403585530d64a74438adef518ae19aa8de74c85cc3c5993", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403361, "uuid": "04089e99-d52d-44d7-8664-63cf73e4c37c", "value": "ABF3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403361, "uuid": "134c8421-43c1-49aa-98ea-a5b7d2a10163", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403361, "uuid": "3644aaa5-7669-4c47-a55a-b5dcd3864484", "value": "3072:MBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHC/:4uXLcclWEc2HeSjNjGdei/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403361, "uuid": "0c122b47-62bc-4cd2-9ced-a4249a619736", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403361, "uuid": "2d2231db-a0d2-4a7a-9398-ad69bf2c00ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403361, "uuid": "b02a88e8-b03e-4682-902b-7afc41a33deb", "value": "07c3a46c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfde2739-aecf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620349313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349313, "uuid": "060d5c4c-4aba-4c8b-8e33-73b481a14c4a", "comment": "Malware payload (Dridex)", "value": "625fce165878ec797e25fd103586714e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349313, "uuid": "e29772f1-9d72-4e7c-bf54-46d85ba40113", "comment": "Malware payload (Dridex)", "value": "39ae85cf0561df23096f4c9f11e16eb1a2fa75cce4b77537947c959747dfcdf7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349313, "uuid": "ae86c3c3-7ee8-4690-9df8-c01705366498", "comment": "Malware payload (Dridex)", "value": "0a7cd46e9879e00c46084b2488d1d5d064d836dd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349313, "uuid": "d2120ac9-6299-42db-a44b-f418e8ce48b2", "comment": "Malware payload (Dridex)", "value": "f7fc8aafde493fdd6ccdb9cff958288cb2a0a330be960957d8cfc7f3eac1be604bb7f2bb5efb3e07d7ff3f3d64a8efbf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349313, "uuid": "5d3c3d01-1553-4c5b-94ca-54a384d23c86", "value": "1EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349313, "uuid": "3f59ad29-6fe6-4386-8890-dcc7684d5d7a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349313, "uuid": "6aa70702-1320-47b8-b1c5-0643b8a4e3be", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620349313, "uuid": "c8c7c24a-e36f-44fb-9678-1241141f437b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620349313, "uuid": "9dfb9db9-0100-4aac-b45c-24b605b4af8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349313, "uuid": "f171888a-f14b-4ce7-a0da-adf88b799eb5", "value": "625fce16_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78dd5742-af77-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620421322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421322, "uuid": "7612479f-7a7b-4b8f-8f38-63a40eb1ac24", "comment": "Malware payload (Dridex)", "value": "9298aae54f6c2577d5189f97a3da5f28", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421322, "uuid": "e3aeb585-194f-46fa-abc2-3e27c01a81e5", "comment": "Malware payload (Dridex)", "value": "3a26a13c8b15e020a2ce6d9ba66dd74908107cd1cf3621fdf13bc4e482c3ceca", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421322, "uuid": "4db90c8a-dc70-4816-8976-ee2e96cf0aaf", "comment": "Malware payload (Dridex)", "value": "2025fbd3f67f494301d76e6cc1c40290242f18c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421322, "uuid": "4019e08b-bae0-459c-aec4-43401a60e93c", "comment": "Malware payload (Dridex)", "value": "2757d1b9b17dbc3a6cbcace5831a328d84627b97503fb09890fc999fca3f8062607865c9fca38e626073647530d7b6a5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421322, "uuid": "e8a94b37-316e-43d8-a713-1a6b8e29724d", "value": "75F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421322, "uuid": "d0a49b16-cdc6-4820-a425-54f5d4bf7c8b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421322, "uuid": "c88322d2-74ce-480d-a837-21f1e50f0585", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620421322, "uuid": "6a783eb0-5231-4b6d-aaac-595b799127b3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620421322, "uuid": "d089609b-30bb-4dde-88e8-7308b2b9e7cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421322, "uuid": "675f6d6c-86b9-4b76-939b-0d9c559061d8", "value": "9298aae5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2917754-af12-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620378121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378121, "uuid": "71447b37-1155-4b92-b9b1-0c37636db379", "comment": "Malware payload (Dridex)", "value": "ffe1a17d0cfb92a4158fe6d2c0fd5002", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378121, "uuid": "e645bf97-9ba3-41ef-9c1c-c57cfffd992b", "comment": "Malware payload (Dridex)", "value": "3a2c844e867b467dea2360f815ef7f59bc5b77a0f32fd5f89a0d18b9fb438ecf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378121, "uuid": "e6b0ca9e-bbbf-4e64-b740-5079dfb12589", "comment": "Malware payload (Dridex)", "value": "29024645eb1e4aeafb45b3757adee6c92f94406a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378121, "uuid": "6751e3c1-1fee-4f6d-a368-edab7a805f23", "comment": "Malware payload (Dridex)", "value": "70130e03d16c50c793f94f488c5e0e5ffd0f2f6f4e51f71f23eb48fb19d000a998058c14548b6d10dc689a41157de21d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378121, "uuid": "77ce0d2d-eb1d-4a39-bd2f-ce86058bcf52", "value": "D3F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378121, "uuid": "ced599f4-11e0-4932-bd68-2dcae9429b63", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378121, "uuid": "e5086651-5d12-4734-8d35-94bc80f6eb4b", "value": "3072:/lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:/lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620378121, "uuid": "4982981a-9bd3-439b-bdfd-69f824a1e4b3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620378121, "uuid": "5a4d3537-7899-4431-8a27-e6ffcddce253", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378121, "uuid": "7b57df51-6f33-41a6-a247-6fc2deb3d388", "value": "ffe1a17d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c0a02f-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403889, "uuid": "d6e4bbba-b862-458a-85f7-a6f948fb1428", "comment": "Malware payload (Dridex)", "value": "273777216ce0f6df92fd845f58e5ba67", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403889, "uuid": "84de9163-2ed8-48fc-b08f-0c4476e41bea", "comment": "Malware payload (Dridex)", "value": "3a3aadda1b1e1e937ec00b09f793253839755cb952ade807eb09d05970860494", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403889, "uuid": "050ec324-d03c-4a3f-9777-24a0ecc5c9eb", "comment": "Malware payload (Dridex)", "value": "d3188c7af1c018b80af13b00165ebc9d579c7ab9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403889, "uuid": "2fdfff9b-52d9-42a7-9854-24bc19777fb0", "comment": "Malware payload (Dridex)", "value": "6b401a5edaded1b7c35b0cb2c8389abd090f1da28db0d1000578c8274d1c957c31cdc8885a228960b529b568cc3e34d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403889, "uuid": "12299a2d-fbc1-486f-ab30-e7912e777233", "value": "28F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403889, "uuid": "ee77cdba-b5d8-4992-abf6-8a2e1bab3294", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403889, "uuid": "86943d75-5172-4365-8398-39540753b8eb", "value": "3072:4BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHHWW:cuXLcclWEc2HeSjNjGdenT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403889, "uuid": "c31e631a-87ee-4238-982f-587ffe5c2d83", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403889, "uuid": "636f5576-69a9-41cf-b083-e12752585a5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403889, "uuid": "0d358f0b-d65a-4496-991c-8ab41f24741a", "value": "27377721_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc3e805-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404074, "uuid": "52f3d2e2-d84b-4c16-b27e-afe31c7da38d", "comment": "Malware payload (Dridex)", "value": "69cb41a90c2186854cd6b93958ca00bf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404074, "uuid": "e43367cd-1d3b-4670-bbf3-c955d428cc13", "comment": "Malware payload (Dridex)", "value": "3a668c77b8e03abe58f54ee3d048d04ac974db7eefb5bc1e7bf4cc6ac91a95e7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404074, "uuid": "80c56291-6c5b-43ce-944d-a5413e7a7f14", "comment": "Malware payload (Dridex)", "value": "f5839104673d05875e2f455464d49a4c4ea1db08", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404074, "uuid": "c58b782d-d83d-41e4-ab24-fd115e3cbee1", "comment": "Malware payload (Dridex)", "value": "e361ca55636e7c5900c6e7540a714d8bbf235b7a65166f7ebdb5708dbc2f258792f98864f66049d34804f6721e3f7c1f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404074, "uuid": "59ce730a-7fc0-4c74-9ac1-4a1574cf1bb6", "value": "CAF3C141C9C5C8F0CBE36C364695963B3628B941995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404074, "uuid": "df0e646b-ac1c-4939-8796-4864c4040752", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404074, "uuid": "82fef001-c766-452f-b266-5bc07125e317", "value": "3072:6uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+em:60czbty9uiaJlHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404074, "uuid": "53b370ac-325b-4c69-b9da-e569e1838408", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404074, "uuid": "8baf1dbf-2c85-4eef-b599-f76dcb64a705", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404074, "uuid": "da7744c3-6fa4-4be1-b82d-d114a8d18f4f", "value": "69cb41a9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c64eb4-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620385179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385179, "uuid": "91018ff6-027b-4c18-b109-97832c560ca8", "comment": "Malware payload", "value": "8fb5cc19a4b3784c602be19efe34555c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385179, "uuid": "226dd0b9-94b5-4159-bff7-6d8e5a8feb3e", "comment": "Malware payload", "value": "3a7809920592be114483fe7f764f4ce9c48f6c7bc1ed578f7b8a5f2130488810", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385179, "uuid": "2699e7b9-2ade-44a2-b63a-966906efd005", "comment": "Malware payload", "value": "20b0ee7e24bf9cce5d34b88378d106f2bea84eab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385179, "uuid": "a8c9aa46-fd7e-491b-b337-22ef2381f008", "comment": "Malware payload", "value": "40ab6b6f2720344f09d7bf4328c8928718786f625e0f141f96dd0c13d758a14fead572a47cc3e887824c58fd179e1e90", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385179, "uuid": "f0373261-3fee-4203-869a-155c718f27ce", "value": "54247D21F2C24876D1631F38BC2BB26D5A36FF152D29654BA6F95D0C8E3E3817C185E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385179, "uuid": "01a35795-fbb1-445a-b888-4f3a5113497d", "value": "ff5a8f4780f2dc45750b55ab89f4b357", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385179, "uuid": "5c4a0868-c8fd-43bb-b807-399654079c7b", "value": "6144:SJ+WK/pvT7arfwKFzDTsv5oaTh45CjBscX9TJLN:JJpb7Y7vf5i5X9TVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385179, "uuid": "38654a63-74c9-48af-8097-87ede9e45192", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385179, "uuid": "6dd1eed2-9935-4b37-9938-cab2e0b4f2f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385179, "uuid": "aa1c642e-df25-4278-9eb7-b7d0b832f1e1", "value": "scr.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015b930e-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403513, "uuid": "cbb41752-d0dd-4570-adeb-9b83f6194891", "comment": "Malware payload (Dridex)", "value": "cf4691cb7d137b8c4cf9aaf60db12912", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403513, "uuid": "2b4fe7d4-176b-4b9e-938e-e0be67d4b573", "comment": "Malware payload (Dridex)", "value": "3a914e4926a65f9aea91f144fa4cacb5cc369c9a573ddb114298da997b05b042", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403513, "uuid": "b920550a-f4f8-4584-96a2-dd441e10caee", "comment": "Malware payload (Dridex)", "value": "8606eb96e8c29d2fd5923c5f18a0f0cb8cc6d587", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403513, "uuid": "276be8dd-1c8e-4632-8e49-494cfbabec7b", "comment": "Malware payload (Dridex)", "value": "c4518bd84dddc9e52c2a91cc08c55017d292ac7c57f1de81b6aae6220edd884dbfa85ae3d3238d2ea64fbb82acbd00d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403513, "uuid": "cbf9697c-29ee-43fd-8641-a2c267eaa54e", "value": "01F3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403513, "uuid": "1e2ca47d-00b3-40d7-b647-fa21732618e5", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403513, "uuid": "2505e4e0-c57d-45e8-9ed5-55ad39d5e855", "value": "3072:VBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHPD:buXLcclWEc2HeSjNjGdevD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403513, "uuid": "683a137d-bad0-4977-8775-c2e069eff38e", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403513, "uuid": "fe68a036-bbef-4df3-bfc1-066093b861aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403513, "uuid": "416dd3df-f805-4686-81f6-ce25bf84cd33", "value": "cf4691cb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa79a382-af35-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620393193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393193, "uuid": "edb20c66-6de2-4899-b249-701b52a7a4a7", "comment": "Malware payload", "value": "300f5ddca9161ac7d694e511a3f34862", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393193, "uuid": "5a581e64-1804-443f-97d2-317460028f25", "comment": "Malware payload", "value": "3ae0b1bc8c390fb60cfddb6ac74125db3ae711acc8fb15fad0a6346c74defe72", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393193, "uuid": "bf293e25-4388-4cc5-a3e3-1e16b47c8245", "comment": "Malware payload", "value": "1c0691677984c4f75d5090a8ec862d5be959895c", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393193, "uuid": "2be54911-886c-4dad-b046-90877e92f531", "comment": "Malware payload", "value": "daf2a9afcae2743ec73254b572e728bb7b284a03246204e4d8418e80330e79aa04cb2394a4cbe65dd6197e1c751757e4", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393193, "uuid": "c7839728-3c89-4637-a3a0-fec5bcccd273", "value": "19E2F0025B0FFCB0DF205E7AFD91064123894E79B41B2150A66423DADFDB853AAFE9C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393193, "uuid": "d62c4287-e6da-4f62-9b65-d6a1eb0af067", "value": "384:M8M7zZQwKDrq0S06sB+YKlD/2NGtJAAGNmIOJ61Z+XRqcbiE8GPVsrvLoEG8LNm5:mnKDr1STINGtiITRXyKIHvwu8+n3Uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393193, "uuid": "8db07269-091c-4a79-b402-5a0d0018c5e0", "value": 32460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393193, "uuid": "9f3f309c-7c95-4e83-ba2e-4ec4d37e441a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393193, "uuid": "824615e9-778b-430d-a613-453042463dd7", "value": "ARMV4L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50abffd2-af1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620381741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381741, "uuid": "adc3272b-f173-4445-92c1-5fcd4366df69", "comment": "Malware payload (Dridex)", "value": "16b729a15a34e4268266db13f26a83fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381741, "uuid": "d5ba0e98-18c5-4a74-9982-401b2cebda51", "comment": "Malware payload (Dridex)", "value": "3af996d63ba2356f60e5be81efd06f00c4131d5b611b5e703aca1deeb7a6f755", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381741, "uuid": "068b7b34-d38c-48bb-b229-62a4fd2626bc", "comment": "Malware payload (Dridex)", "value": "a2b72bddb9bf21f69afbb8b26636c9c94fcb95ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381741, "uuid": "58e908ec-3594-4a18-81a2-79f9a74f0b79", "comment": "Malware payload (Dridex)", "value": "276024d63020fe6164c171a5815b6b52a6b12d3b6374fc2c87ffdad1c5119dcf91845dca589e4cafa52363ebfb3d7ad2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381741, "uuid": "01d48eea-1fa0-4142-b55c-73d19d7c8eaa", "value": "0BF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381741, "uuid": "964382c2-5e74-42fa-9619-f9e447f847bc", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381741, "uuid": "f47a5148-b565-43e8-942f-fb8cf32172d2", "value": "3072:be45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:64KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381741, "uuid": "a2c993fd-3450-43a1-9b0b-3de8ac2dd0ce", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381741, "uuid": "a3427a30-7121-4312-b1e6-e63f6968a615", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381741, "uuid": "e0f0d497-f5a5-4814-a4d8-11fa97f8616f", "value": "16b729a1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca79958-af1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620381761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381761, "uuid": "a934ba6a-04d7-48b7-8f5f-5b60e62f11c2", "comment": "Malware payload (Dridex)", "value": "6f2386fbb791e93a117bf985d3a1ae82", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381761, "uuid": "f4ddd113-9a64-42df-8add-aa8705442609", "comment": "Malware payload (Dridex)", "value": "3aff17dc2e21adc5bfbdff549ead82189bc8ba49f2ca5dbb8c2b1717b025a0b4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381761, "uuid": "697d17fa-471f-471a-9cdb-030540942a1a", "comment": "Malware payload (Dridex)", "value": "f58930651703af47fc74c9f24bd763b0ebb68683", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381761, "uuid": "7b87e266-5832-47bb-b3af-21f36d37a5e4", "comment": "Malware payload (Dridex)", "value": "cc333fe64fba59044b137327d857ff00d94ea0bd23f16d1bb6387f963c266bfa75b42714525e4b13e88e067d75a2fec7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381761, "uuid": "89191c07-0dd2-43c3-a045-226d62886e33", "value": "AAF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381761, "uuid": "c61384e0-8971-4457-aab6-d34372bdd754", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381761, "uuid": "ddf7f03a-4963-4398-a834-71f5116cd92b", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381761, "uuid": "ba3f6659-bac6-4e18-a127-6864ad1beefb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381761, "uuid": "7d0b8252-efa3-4b0b-b426-098ae312f3d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381761, "uuid": "3725dc8a-e18c-4cb2-999b-a05bd963ebcc", "value": "6f2386fb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d49cc3-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407354, "uuid": "0dbced8a-d8a8-4f30-9a6c-46d57db8d146", "comment": "Malware payload (Dridex)", "value": "c1a7ba3f1e49ce871ffc77adf3f7c975", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407354, "uuid": "ef0d53d0-23c7-45ea-b4ef-aaa4bfdd68b0", "comment": "Malware payload (Dridex)", "value": "3b25e3577fd0c421df3e4ad9c01fa6a64c360c8e294e8a2ce36ae8878ae58168", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407354, "uuid": "a21ad7e4-f173-4254-97d0-e517400d1493", "comment": "Malware payload (Dridex)", "value": "910da452c2f2ded4a57313e393bf5cbcdd7c4a2c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407354, "uuid": "fd06276c-32f9-43b6-8d5d-cb38a4aca7f8", "comment": "Malware payload (Dridex)", "value": "acb958223606a0afacc09d51cae9922ae91e2576747e55bc4085e9dd1f87939ca106809ec8ace2ca363478c25b0b733e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407354, "uuid": "42d44bce-9e64-4189-af74-8b8e542633ca", "value": "2AF3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407354, "uuid": "e7989800-cf17-4574-bee0-749494ad310f", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407354, "uuid": "0bbb174a-471f-4fea-b418-57e9d3b7edc0", "value": "3072:mBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHSa:euXLcclWEc2HeSjNjGdeya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407354, "uuid": "26728983-41ca-41db-9725-ceab18f9255a", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407354, "uuid": "59dfb098-5a8b-4fe5-b811-6dbb9c18f07f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407354, "uuid": "24ceb4dd-c775-41dd-8c8b-0a0d450f6c0a", "value": "c1a7ba3f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c125faf6-af7f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620424880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424880, "uuid": "2ea4fa53-c522-445c-af4f-13cb7be51d98", "comment": "Malware payload", "value": "8d5af6fc1dff2028fb76a23ecf5ffba8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424880, "uuid": "9c2e4bcb-6702-4a70-acb5-6f706b27997a", "comment": "Malware payload", "value": "3b2889d244b1ab267200cce16ee864a7f43a4132bcdd04569ab349743585af4a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424880, "uuid": "9198ad98-54a5-4bb9-839c-e16f61b5f16b", "comment": "Malware payload", "value": "bce45c4d7895024d95af26e00f0b8a38b62fceef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424880, "uuid": "69ed5a8a-7755-4793-a65c-01c43083cd6a", "comment": "Malware payload", "value": "2211d0e5f0a7ff352b1ac22ec9f4d720d304aeef42af350f596505907a2ac59b006f6212c44499bded172364020e1ad1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424880, "uuid": "8111452e-6936-4553-b79e-96b5b2f86a34", "value": "90F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424880, "uuid": "7997b6e1-b3d2-4fc1-854d-5cb36d65a318", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424880, "uuid": "e27b2645-cfe5-47e1-8dc6-d1431a87d5a6", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620424880, "uuid": "ac5fb554-6be7-4e21-9dd0-8efaa7519b0b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620424880, "uuid": "2227a628-67cb-47ed-b736-36779183e923", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424880, "uuid": "dc888aca-97f4-4e65-933c-0f9e71f721b8", "value": "8d5af6fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d997053-aed8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620352852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352852, "uuid": "39414ff2-2c24-4869-b493-2f0254b4bb2d", "comment": "Malware payload (Dridex)", "value": "76319512992cf11ce14e17e402caa761", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352852, "uuid": "6200819f-52bb-474d-9041-93b6fad6e605", "comment": "Malware payload (Dridex)", "value": "3b405268a4d880b818cdd14a8462b02c88826286605351729bce6f65fae145d8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352852, "uuid": "47e89b9c-84ca-420b-85bc-a8ae50309247", "comment": "Malware payload (Dridex)", "value": "2c26eb3fec23673a15d28526f9426c5fc5cf704e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352852, "uuid": "2d52dd5f-bec7-4d6f-9506-3bf147f66452", "comment": "Malware payload (Dridex)", "value": "da006e95952d32f5b3a810109a48509fa341e98ca9a2a1f84b95b827fb9d22d5777fbaaf12c92d42ef7bec3bba9ade47", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352852, "uuid": "66b6f7a4-f32d-413c-8107-dd5678a24c8b", "value": "AAF3C088CBB3E4E6EFB2D37976F85E1B460674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352852, "uuid": "a4e38542-90f1-43ac-80e7-52676ce1ba97", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352852, "uuid": "80d6159d-57bb-471b-b5a9-c52e88057051", "value": "3072:GIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Pc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620352852, "uuid": "7cec2096-dc00-4a8b-a1e4-5ee60cacf791", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620352852, "uuid": "6089e178-3a67-4260-9694-5990abf7d1c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352852, "uuid": "df417f75-95ba-4f20-8c69-d70a4357b5b2", "value": "76319512_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d203234-af25-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620385950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385950, "uuid": "bd03b4b6-0d66-4ee8-887c-7fd0e47191ec", "comment": "Malware payload (Loki)", "value": "c1f0326b91d934af1c7fbbb0ad9891c6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385950, "uuid": "9ec7e985-1fea-4e9d-9d76-c447ac33b096", "comment": "Malware payload (Loki)", "value": "3b576baa49a835ad227bc4f282a1331e833ccb74b80d05a4327b21fcd4efd708", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385950, "uuid": "87112f28-1cb5-4b3b-a934-a2e44a788ec6", "comment": "Malware payload (Loki)", "value": "1ef2a8fbc1b9c3941754a8aade5fdee7a8ccd198", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385950, "uuid": "2d9d2585-15a2-42ae-a6db-1388e833d41a", "comment": "Malware payload (Loki)", "value": "05ceebd3ad10f0758c1c879fb31b973d77d4106aa3eea48ee4614454e4a56103f5c4c4a15bd5bda444b7f74555ed07e8", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385950, "uuid": "f6f69939-1632-436b-9f84-89826cafa0b2", "value": "F5259E44759AD631FFF2D571D82A6B6D0DB58AB0728D2AC3E506EB32A3F03D07B54221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385950, "uuid": "eed3aca0-66c1-4f77-8374-17acb5bbb1ca", "value": "c23147835bebe30ce0399c6e0f66fdf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385950, "uuid": "62d520b2-6768-4e12-b0c4-36389ddbdd57", "value": "3072:VOo3cwzg4iKdVFwe+GMQotRVrcVzTiJ54ta3WDSOMX:koEIdDwe+GvotRVYAi5SO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385950, "uuid": "ed1ab3d8-47be-4686-975f-782d5abdfa30", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385950, "uuid": "614941ab-09b2-4aa2-bbc9-380a8d2e7301", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385950, "uuid": "4ce83d68-eb47-45ae-965b-08183ece5db7", "value": "south.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a5486d-af45-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620399701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399701, "uuid": "04b1d5c2-3102-4de6-b45e-ffcdef2d658a", "comment": "Malware payload (Dridex)", "value": "a941887567a58aced8c57b4339b5cf23", "object_relation": "md5", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399701, "uuid": "ab814162-74c8-4028-854a-d19459def072", "comment": "Malware payload (Dridex)", "value": "3b57c5b0db1774c580a27927bdd4ae5f5181e77170b314e6f5b39164769f4f88", "object_relation": "sha256", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399701, "uuid": "5e57cddb-b329-47ca-8bd4-624e982ea44a", "comment": "Malware payload (Dridex)", "value": "7f9098923ed7c78c2d7e2c77fba4b73561c2635d", "object_relation": "sha1", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399701, "uuid": "6df0c0fa-3566-4efc-8634-b7d862341eb0", "comment": "Malware payload (Dridex)", "value": "ad1424114839bc5c50daa2948502554a8d7cb3696e94c837e870a268c60d58c949c29de9f39d48937a37161b9e1325e6", "object_relation": "sha3-384", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399701, "uuid": "8da5ce3a-7130-4a6e-906f-336f07123d7a", "value": "17F3E081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399701, "uuid": "a980c3bc-81f4-444c-ae41-aaf183762543", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399701, "uuid": "0903a49e-54b3-4905-99a7-f5d45131e590", "value": "3072:9BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHAh:zuXLcclWEc2HeSjNjGdegh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620399701, "uuid": "ce097dd2-6920-4428-8570-9af350d917ac", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620399701, "uuid": "bf964a22-5c37-422f-9476-9b49c7d0c993", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399701, "uuid": "4e16c1a6-41b0-44b3-a562-a6492d2145d0", "value": "a941887567a58aced8c57b4339b5cf23.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10031a0-af39-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620394868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394868, "uuid": "9b5ad79a-9452-41d2-acb4-359b1d2b0698", "comment": "Malware payload (Mirai)", "value": "63022561b2da16c3e72b6a7ff8c681c8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394868, "uuid": "9bdfa4cf-dfec-438e-b007-d4350729eeaf", "comment": "Malware payload (Mirai)", "value": "3b6c5f73a1051b6bbe6409fa582bdf68959f81cdb5c3b0a00906c07ad9b7eeb1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394868, "uuid": "7a72214f-f98e-4348-8939-94111a87d12c", "comment": "Malware payload (Mirai)", "value": "248d84ace21d28b969372d1e0d107d47fe061eae", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394868, "uuid": "e499cf58-2cc4-49fe-a0b7-677848fc0ad0", "comment": "Malware payload (Mirai)", "value": "34bddeadc7098e8d4a5bfa6ee0e7cbc2f33daedde59950429db4b46996123893c5df64eb32fac1a87ef00a590deb21ff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394868, "uuid": "4158339b-308e-49ea-8915-785014352985", "value": "9483C3C0B98B85F5C51B493050A7F23FDB32D57A1070EAAEEF9D9E35EE27602910624D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394868, "uuid": "c8be4b1e-6b88-4dd9-a326-5ce38a2e8515", "value": "1536:w2l1f1NJZLdo6U/UjHOMGNft0OPCKyhG3dkdbRp+Xi+hH5U4n/32C:w2l1fLdop/UzONft0OPCKycd2baXzHG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620394868, "uuid": "b6aad8ab-f125-4fa8-a432-6bc36226e438", "value": 83696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620394868, "uuid": "b0620814-12f0-4c77-9998-3d49423fb97a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394868, "uuid": "a1d8b58b-b775-4032-9cdb-8381f1d62c31", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00eb2da-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620385364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385364, "uuid": "752f297b-0a8f-4bcb-8aa8-25e2e5df5c36", "comment": "Malware payload (IcedID)", "value": "39bd68d061ab1ddcc852f32bf195a6e8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385364, "uuid": "95272e35-c983-4940-88cb-eab16bd2c5a0", "comment": "Malware payload (IcedID)", "value": "3baf068c93eb7ba51828b6d6eb27cb698e2456ad23b86103d734c30a3afb8755", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385364, "uuid": "a183e7bb-828d-4cd0-ab47-4ca6f2867f8b", "comment": "Malware payload (IcedID)", "value": "c779f164e8a4af2701b13c894b19e6417734e340", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385364, "uuid": "67d59457-6333-4452-83e2-1f4116cce612", "comment": "Malware payload (IcedID)", "value": "96b3aa5670e38618c2962b46c385e47745e72cefa4bb74ef065563a888ded6dc8ee82767f45e82e31ded6b8c65d49b1d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385364, "uuid": "9ebd41f2-41e0-4a8a-9fd9-39e8bf6e021c", "value": "64139E69F9EE52F5F44A89B4F08DD31A661DB222405E1A7FD0258FF3CD56223230D25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385364, "uuid": "bcbca1b9-6438-492f-8039-7f2fa9c3fe3d", "value": "78ed290a779aa51d4473678936319a48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385364, "uuid": "e1f66a42-fc7e-4bad-9a08-689cccee1890", "value": "768:St5V8AoQM45rBwp4U3Ffi7FtdnRFm4O5mgjNdPz1w12ma2q0:Wz8AdrnUN4tzO5mgjNdL1w1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385364, "uuid": "68dd95d6-a638-4816-a68d-fcbcd857ee42", "value": 44681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385364, "uuid": "3acd93e6-c6ae-49fe-8a24-4537678cb106", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385364, "uuid": "104f7838-1f34-4680-ab87-1611453b092f", "value": "39bd68d0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c8f376-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403632, "uuid": "f7f5ef50-0149-4abe-b21a-d65c897ac1a7", "comment": "Malware payload (Dridex)", "value": "fa360d1bdefa91c5c7acb1bc3eaca119", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403632, "uuid": "f43f000b-c6cb-4a43-b20f-c8bc811ec658", "comment": "Malware payload (Dridex)", "value": "3bcc9e2ab827da6bc5c8c19c763167168a4aa2d09a64b21040ea5e6b06fd7e75", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403632, "uuid": "d57c123d-18ca-4a6c-afd8-3564557d373d", "comment": "Malware payload (Dridex)", "value": "cc05c0010ba2e5bfcaec6e914eee1e354f1b2821", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403632, "uuid": "01130030-6702-44cb-9745-a41334399dfa", "comment": "Malware payload (Dridex)", "value": "d3d3d51c04c88bfa490b8944effcb73617eaf380783fc0894861985af68c7e0a8909b080bb8402f6ac2107dab6bc4749", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403632, "uuid": "dba0cbb9-9201-4b19-ad6e-41d880d6c277", "value": "6AF3C141C9C5CCF0CBE36C3A4695963B3724B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403632, "uuid": "687fb171-2b73-4caa-8128-45ab90d74db8", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403632, "uuid": "9bdfa176-0349-4976-ac5b-0054f905e0a1", "value": "3072:6uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+Lc:60czbty9uiaJl6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403632, "uuid": "92552514-5063-48cf-b2eb-3b18eb6e0a8f", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403632, "uuid": "6f9d10d4-bb13-4cc3-8fbf-5008a6aa2e5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403632, "uuid": "122df6e9-7abb-4928-b8f6-6cc8abde7adc", "value": "fa360d1b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b795c1e7-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392222, "uuid": "87fa457d-e4c2-4061-afc7-3a350e66bda9", "comment": "Malware payload", "value": "f1daad600e523adc83724cb6513276fc", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392222, "uuid": "94d01ca8-e10e-4a43-a368-d4ecd46b73af", "comment": "Malware payload", "value": "3c0880ffab65d793601747d2397562778fb271e95280e6c23fca166e19699035", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392222, "uuid": "8301397a-485b-4ecb-99d6-a15d585f64b5", "comment": "Malware payload", "value": "07523e8576964ea1d38bccd9179e240cdf196a97", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392222, "uuid": "5ecc408a-556e-4404-8521-c1cad40a21b1", "comment": "Malware payload", "value": "580e550397f935fb8b37c8ce2fc6f8c0b24f7f9a3b9342eb01dd9c838a76a4657479fe4d201dec7e07e35024580895cd", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392222, "uuid": "b30b9105-65ed-4357-a1d0-6dcab2d123eb", "value": "F3A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392222, "uuid": "8bc03c1d-e89f-4f78-9c6e-aae61cb8866d", "value": "96:wRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:wRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392222, "uuid": "ffecabee-0659-42ca-aee3-193df45cd257", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392222, "uuid": "c315e918-8a3d-4e6d-a65a-235c66905892", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392222, "uuid": "dbc61503-0b7d-45c5-9cd0-656b9b1d1ce9", "value": "3c0880ffab65d793601747d2397562778fb271e95280e6c23fca166e19699035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40205edc-aec7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620345636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345636, "uuid": "d45600d5-af9e-4f44-93ba-f2bf0ba3e74e", "comment": "Malware payload (Dridex)", "value": "cd8a934e1483502be883edef10fbf937", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345636, "uuid": "5c0486bd-95b5-4284-bda2-914207a0c021", "comment": "Malware payload (Dridex)", "value": "3c1e2c2a30baac09fba6090784383388c8d663e11b01c11f5d05b11727626da2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345636, "uuid": "0220a1a6-96f8-45ef-a8e3-e2582fbb18a9", "comment": "Malware payload (Dridex)", "value": "d69b13491ea09a505ffdbd3bf338da63bbb3d41e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345636, "uuid": "e92ae4db-c9d6-499f-ae54-8d90d27d7cb9", "comment": "Malware payload (Dridex)", "value": "02b583c38161cb7c5794710fc31447d155ba10294df6ed7b8c7085ed6ac44e58e65ebceddde0ffd2e34833c7fc4450a6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345636, "uuid": "e6538338-72e1-42ac-9ff9-3c88fc360c21", "value": "3FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345636, "uuid": "d69006d9-90e6-4803-bb70-6d4a1c749684", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345636, "uuid": "dd733978-5bc9-48bc-a596-7694800999e9", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620345636, "uuid": "b27910c0-1d36-4c4b-8261-235e92b706e9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620345636, "uuid": "e73ce202-c8ea-41b1-b8bf-d56c43a1bb0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345636, "uuid": "6c369f43-5c3c-4372-8ad7-cf5edf6c3afd", "value": "cd8a934e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f26369-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404002, "uuid": "057a09fa-89c0-481c-937e-3e14ba98177e", "comment": "Malware payload (Dridex)", "value": "86994e985ea1d2e717d4dd4ab5d7ba84", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404002, "uuid": "ccdfb87d-7898-4b69-8c17-5c5b47df5d4c", "comment": "Malware payload (Dridex)", "value": "3c2a9c68f54784b7d06c33ce93ee34a036a8e52c38b0b2e156e5d18fec42d908", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404002, "uuid": "1b11265f-1e00-4e62-9f41-6fbfc12f3d81", "comment": "Malware payload (Dridex)", "value": "2b492374925df546e9163ec29f77d09f921e9009", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404002, "uuid": "017a988b-5a8b-4e9e-a856-233f9697194f", "comment": "Malware payload (Dridex)", "value": "d87933e31ddf2db1ebdc8e96e507b36a7294ad35d0c3f9e88047fb2029026f3a655d0afdbcd40bdd838f2a996bc559eb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404002, "uuid": "a987291a-9ab4-43c0-b9b3-9eae187823d2", "value": "A8F3C141C9C5CCF0CBE36C3A4695963B3728B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404002, "uuid": "4cca1887-0336-4f88-80d5-7316d8e5ba67", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404002, "uuid": "65523d37-e21a-446e-95df-743f140008cd", "value": "3072:+uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+zN:+0czbty9uiaJlGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404002, "uuid": "bc808a50-6c61-40cb-a14d-228c050807b3", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404002, "uuid": "7012f60f-5c68-45cd-a4d4-49de21cb5782", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404002, "uuid": "69b4d081-bb27-4ca6-b3e1-3757bb090223", "value": "86994e98_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f971e128-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403499, "uuid": "1134536c-6786-4516-8b0a-42cf94b511b7", "comment": "Malware payload (Dridex)", "value": "58b7e42e2a0106015c1b98b8b5ce12ca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403499, "uuid": "7a061e1d-e5d7-441c-9195-57ddb3afc454", "comment": "Malware payload (Dridex)", "value": "3cbef64a905cd2d4daf303eda669c1f425dae6a2e917851bb90a6ef1e112a67c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403499, "uuid": "bc628263-a11f-4226-bb26-fc731df22d17", "comment": "Malware payload (Dridex)", "value": "721687f6fdf87df3ea21ba08c5ead8e68a9ecc4f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403499, "uuid": "0e9dd7d0-a7af-4a67-9d9d-fc03379e34e0", "comment": "Malware payload (Dridex)", "value": "b1404492dfad8bf26b62f0449d5639e6b4bfb771592dd1987631da54afe8c4bf4532499dd530aeeabec3b58c276c9ecb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403499, "uuid": "a1db3ea7-8b09-4ab0-a966-143feaf4aa5a", "value": "52F3D081E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E051A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403499, "uuid": "6b206b90-d57d-41d1-bdc9-eb39c1a394b3", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403499, "uuid": "1f98172e-c721-4b98-82ee-580096ace826", "value": "3072:TBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHji:FuXLcclWEc2HeSjNjGdeDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403499, "uuid": "e2b56ea4-e88c-43d6-a9d2-68fe79f2c88a", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403499, "uuid": "155038ba-2502-4b94-ac60-ccf2dc40cce5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403499, "uuid": "dd981112-d1eb-47ab-90d2-0568f292714b", "value": "58b7e42e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c273c3f1-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403836, "uuid": "24f5dc1c-c15c-4bfc-9544-2d4d8750be91", "comment": "Malware payload (Dridex)", "value": "a1bddc77e45304b6f544b75223613c08", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403836, "uuid": "55fd6429-c178-43fb-8dcf-b1120da3b84e", "comment": "Malware payload (Dridex)", "value": "3d08bcf944cb9739978d482eeaab6ecb56531af80f8cc5c0a832b12cb3132d77", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403836, "uuid": "7b786a75-fa40-45ad-b021-c6424505282e", "comment": "Malware payload (Dridex)", "value": "4561cb06511d4053e1147931f46be4821569a3fe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403836, "uuid": "1c194dca-cd15-44ea-be6d-35a8c13cf8e9", "comment": "Malware payload (Dridex)", "value": "271bf2b91ebb9d25857674c76cec61e7fd6c63eab72d0ec39e2a6e883da2b4d37fdd24aa34ae76b2d42fe937e5b75551", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403836, "uuid": "a02a26d0-ed1e-49a2-82f3-f2a979f03b29", "value": "56F3D080E7CED5E0FC079B333E680EEF52310087691954E4EF29DABD96BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403836, "uuid": "079bf3f3-4ff5-467a-950c-a9d713f7909a", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403836, "uuid": "cf2bc577-757d-4ad4-acac-8b8a2b4cb8ec", "value": "3072:pBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHS4:3uXLcclWEc2HeSjNjGdey4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403836, "uuid": "783040e4-9cd9-44c5-be6a-cf13d489999f", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403836, "uuid": "67251636-bb7c-484a-8cc5-03cfcd935cd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403836, "uuid": "249f4930-6055-4d5a-a342-08f8beb32bf8", "value": "a1bddc77_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15ffa0e-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404210, "uuid": "750131ec-ded0-4d97-8465-d20d02a51118", "comment": "Malware payload (Dridex)", "value": "e2dc119eb50c9cfefb206650874c0aba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404210, "uuid": "e4c92158-0471-4544-bd87-a94563971713", "comment": "Malware payload (Dridex)", "value": "3d13ea6839febf24c6abb3499e9dd8b53c13f793ab7b352261737f6d759b2d4e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404210, "uuid": "6c11f44d-c17b-45d2-ae6a-6314641de25a", "comment": "Malware payload (Dridex)", "value": "41b0f880dfc83271bce526a70db1882a9ed20b96", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404210, "uuid": "1087fb8c-dcda-4fad-bae6-5ce9f6a7c1a6", "comment": "Malware payload (Dridex)", "value": "e50f8f180d21bfd8c5558d4796bf4100faa8a9949abd6838d43d0cdae16c34e539e327a475c56928066f2e2ea2d02b50", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404210, "uuid": "97e527ee-36aa-4fdb-a76c-aaee8263e706", "value": "2AF3E081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404210, "uuid": "b4eaeca1-506d-478e-bceb-e2b1f94a0667", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404210, "uuid": "4044b8e3-ccf3-492f-954c-b205f456a541", "value": "3072:KBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHAh:6uXLcclWEc2HeSjNjGdegh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404210, "uuid": "b08d8e36-5cd9-4b94-a03b-dd31a694bb3b", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404210, "uuid": "28e1af34-9c7b-417d-a51c-0cf7fd03e9e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404210, "uuid": "61ba2767-36e7-4ceb-92a1-62337ed5a6e8", "value": "e2dc119e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2c91e5-af12-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620378133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378133, "uuid": "f34b152f-f9b0-4ad7-ae38-c70652fcb1d6", "comment": "Malware payload (Dridex)", "value": "9ab6fdbbca3919b0a425ec2519a78741", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378133, "uuid": "e1e9a63b-4be3-4ebf-8f31-e8a61f3e397d", "comment": "Malware payload (Dridex)", "value": "3d24f1bc26fdabdd6f2de1b1c9c69804ce47dd6532eb4144b2a75ac3b2cbfb8f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378133, "uuid": "ef9530d2-2d71-4f50-8028-9f62018ff1d5", "comment": "Malware payload (Dridex)", "value": "44311d77e0ac797b7a8360ea49819400f2ac36ce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378133, "uuid": "41591b93-4338-49b7-9e62-9821ede84075", "comment": "Malware payload (Dridex)", "value": "a459fb426c51a432f087d1ede325509a3b12d8ad22eec69e7fe4d542dbbd377b22c9ea7e03c7b4a17628169973ac05ec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378133, "uuid": "39627607-803c-4cd1-8b50-a105ba02db38", "value": "B2F3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378133, "uuid": "87c856b1-144f-491d-b9bf-8b2fdcc11259", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378133, "uuid": "71f3872e-fee5-492a-915a-bcc34b1880de", "value": "3072:Te45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:C4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620378133, "uuid": "fc9f1bd4-6de7-4eb5-a755-5d16bb652098", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620378133, "uuid": "6b74c8a0-542f-413b-989d-3dc18f25aea4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378133, "uuid": "eda0adab-1fe8-40ee-895e-0b5d9a1df285", "value": "9ab6fdbb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b941c67c-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403821, "uuid": "9845423a-4ae9-44d2-ba9f-7571b7a08813", "comment": "Malware payload (Dridex)", "value": "9bd12e20c014ccbd6adca25d4fb06399", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403821, "uuid": "c5cfdc04-45ae-419b-a43f-0f7de72aa98b", "comment": "Malware payload (Dridex)", "value": "3d891ff1dff692151ddc269ebb7e09e86f7f1651a226f7800daab57cb273275f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403821, "uuid": "4b5de6e6-35f9-457d-b45a-119066a74073", "comment": "Malware payload (Dridex)", "value": "49e94f124e62609984b26fb7f58b709e5ada5e2b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403821, "uuid": "6d1526bb-571a-45e5-ba66-5e839ec4bd14", "comment": "Malware payload (Dridex)", "value": "a88a111cf736961b88f8765e3c3b8cf3a6d35c51cd0e16a53f32e8b60009102660a18344914fba957b99537936d239f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403821, "uuid": "d15fe74d-2e02-4bf1-915d-9b5dbd860afa", "value": "74F3D080E7CED5E0FC079B333EA80EEF52310087691954E4EF29DABD96BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403821, "uuid": "d3d2f108-1f65-499c-9477-395295e487dc", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403821, "uuid": "7127a4e2-3861-4dce-92a2-b417162ae4e5", "value": "3072:VBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHS4:buXLcclWEc2HeSjNjGdey4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403821, "uuid": "e83a105b-f930-4ccf-a7b9-5c766aa3eaeb", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403821, "uuid": "db28cd44-705c-47bc-bf52-84e5c769939d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403821, "uuid": "ba995c15-bb83-4f3d-8e5d-a9e58ad95989", "value": "9bd12e20_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0ba032-af35-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620393061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393061, "uuid": "7a3828ed-e24c-4b9d-930b-257d9a6bc829", "comment": "Malware payload", "value": "f73c56742af23379f95f9cbff7a4e48b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393061, "uuid": "fbc284f3-778b-444b-82b7-0ca81e84b919", "comment": "Malware payload", "value": "3dcb5eae625a99a0047275c4de6460225198c075b157091599cc3eb88ddf7876", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393061, "uuid": "a4ac673d-0a6d-49b5-8852-9af6b481efd9", "comment": "Malware payload", "value": "d5168a24266f6bbab221cc45a9bc76446f822a99", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393061, "uuid": "90dfb612-c8fc-4f30-ad03-fbc4711c2449", "comment": "Malware payload", "value": "6c500c8213af6d6474f7c1db3b4aac08be70c4885f286120a705a77f454ad6c45f26030fd65abaa8e5f3baebde9bb59c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393061, "uuid": "c14853bd-0dbb-4165-8640-227b4f9b029f", "value": "A9635A25AC391E17C0E891BE52F78B65B2F5270E14A48B6D3E300F8EFF559E4A507270", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393061, "uuid": "940ab9bd-dcc5-49b2-8777-004faf1ceae0", "value": "768:0C7mrH8o0o6J4DhI87wAxBn5+wxb9nB8KA5LtHtOw+kbZmjEgFdvnrj3w74ldcCd:0Om8o05J4DhI8hhh/dcgwYDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393061, "uuid": "58e1ee4b-80f7-4fb6-9bc9-2d8081aefa72", "value": 66832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393061, "uuid": "2c66a57c-01bf-4b48-ad73-0e9067f95023", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393061, "uuid": "e79e5aee-4e54-4ad0-b2e7-25c030ab019b", "value": "94VG.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b84677-af6f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620417744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417744, "uuid": "2d4e5b92-7244-4c40-8fbc-0e88bed30ea9", "comment": "Malware payload (Dridex)", "value": "752584208d22de2331262d2da6925203", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417744, "uuid": "e07495f5-0b26-45c8-82c9-3f86f0fcca1c", "comment": "Malware payload (Dridex)", "value": "3e41df16157d02c9c07100ebf07f2682c3ce61d5a615f456e01a43d0c3829d7a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417744, "uuid": "9f2bac9c-1eaa-4a68-865d-3f5820f20282", "comment": "Malware payload (Dridex)", "value": "2dc7a8c4e7d26dd7c276a38ce986eeddd73dac89", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417744, "uuid": "49f158b0-4b95-4397-9e80-889ff53b21a4", "comment": "Malware payload (Dridex)", "value": "5143688732d61f3a4e7123fb20a19b3db56d363b81a6f31dbcd4ddacaa7e2222e0f2b270168bf3d349f709b7c8222bec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417744, "uuid": "13cb0107-8828-4e29-aab7-9d0602f47888", "value": "CEF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417744, "uuid": "645cbf4e-6907-4639-9e86-f288a4f64a3e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417744, "uuid": "cb7f2065-f2a6-4d69-9785-80a00bc4c781", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620417744, "uuid": "877b5e6a-e481-4b18-bde2-9fd52a33076c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620417744, "uuid": "056ebdf2-45c4-44af-8ba7-e98dd286bfdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417744, "uuid": "2dfc051e-730e-42b2-a0f6-bed1bf79123d", "value": "75258420_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556e6273-af1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620381749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381749, "uuid": "4827ddac-0275-4bce-94a7-09a01b6897a7", "comment": "Malware payload (Dridex)", "value": "eceef419ab4add78c80addfcb7be0601", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381749, "uuid": "b2103084-3103-44e8-b1f7-7d1e33929589", "comment": "Malware payload (Dridex)", "value": "3e4812831f9ae169359af6a4d83b8842ff0cb52ce5353f57ebed692d0d4a3215", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381749, "uuid": "26f3d8cb-517e-4a25-abae-6f2d968bc856", "comment": "Malware payload (Dridex)", "value": "6df26df4f6ca452f9e95349f51b3fdc58ec43ecd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381749, "uuid": "31dd94c9-7200-40eb-b4d6-4eea8ac52b52", "comment": "Malware payload (Dridex)", "value": "fd1b4f00fcda1fec4cff2387fa62993ef0baa58637206f31638b3eeaafdb02f06c18f42bc9fafdf15bf4368026e5789f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381749, "uuid": "da93998f-c564-41d9-b673-36be524b317b", "value": "35F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381749, "uuid": "712508af-286f-4ca3-8dfd-a66500ce20ca", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381749, "uuid": "e026049c-ce70-4f10-9769-48bf226b4622", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381749, "uuid": "3127af54-68a3-4835-9c8a-bf1241e4f98d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381749, "uuid": "94edc978-5b18-4eb6-b90e-b9f045cb1d32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381749, "uuid": "b4a34d43-f7dd-4c7f-a099-7068054100c7", "value": "eceef419_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa36dde-af3d-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620396611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396611, "uuid": "727e2297-9a02-4ac1-8852-7cb6f826c6b4", "comment": "Malware payload (OskiStealer)", "value": "5c71ba785015365d371ac1f21072fa23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396611, "uuid": "0c86b869-047f-4273-9ab0-14fb668a2f5c", "comment": "Malware payload (OskiStealer)", "value": "3e7063017d638a0ae77d3576ffe9fc6c2c8e48235e010b35b697eb944c79cad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396611, "uuid": "f12e18ca-d429-4610-8e8c-3dbc7420317e", "comment": "Malware payload (OskiStealer)", "value": "0b7ca3cdf7cf3c3a6ccd34ac2c610b0757748697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396611, "uuid": "4869d044-575f-4a1b-9af3-57a7a9cc58c6", "comment": "Malware payload (OskiStealer)", "value": "34fc008f34a905417d0f14f627cfe7abb84c16ee0b8afc58ca3a278a98c60560c9870c80d12912667baad66c48915b1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396611, "uuid": "2257f1c0-602b-49e7-a652-65cd774daa49", "value": "F1F4E09952985684FCEE6B3A1F34D8314331BE24A9A5D34E1BF87C6B37BD3834021697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396611, "uuid": "5fb3826f-c0f4-4960-9a80-a7f662dad3e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396611, "uuid": "c45486d4-079d-4a7c-8e98-7bc6083a2448", "value": "12288:YVy4AQChgHJeI5N5p+s5uzHpOjql/HG1/HP+MbPMl7X6KKKKKKfj6:p4JyEHWs4zV5mdv+EPcX6KKKKKKfj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620396611, "uuid": "82e66799-02e0-494c-b1da-08c7a91619a8", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620396611, "uuid": "89eeed0b-c616-48a5-bd9f-336173c8fb6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396611, "uuid": "9b86b3c8-7855-4573-9d5b-fbcb05628c98", "value": "Purchase Order 07052021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122e1c99-aeeb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620361021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620361021, "uuid": "8682c438-0104-48a4-be6e-cd45720f7b9f", "comment": "Malware payload", "value": "a2c4ee84e3a95c8731ca795f53f900d5", "object_relation": "md5", "Tag": [ { "name": "Moriya", "colour": "#694164", "exportable": true, "hide_tag": false }, { "name": "NtRootKit", "colour": "#140600", "exportable": true, "hide_tag": false }, { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620361021, "uuid": "ee57c5f7-b674-4d5c-bce8-6086ed0848b1", "comment": "Malware payload", "value": "3eda93de4a1e7a35c040fad914a4885d079ffc3c1362153b74e10ff9121de22b", "object_relation": "sha256", "Tag": [ { "name": "Moriya", "colour": "#694164", "exportable": true, "hide_tag": false }, { "name": "NtRootKit", "colour": "#140600", "exportable": true, "hide_tag": false }, { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620361021, "uuid": "effe6023-4832-4c83-8ee0-c8ce6531dd21", "comment": "Malware payload", "value": "b6a6c326dd992bb1f75c85675500d8d666e1f1ec", "object_relation": "sha1", "Tag": [ { "name": "Moriya", "colour": "#694164", "exportable": true, "hide_tag": false }, { "name": "NtRootKit", "colour": "#140600", "exportable": true, "hide_tag": false }, { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620361021, "uuid": "5e26b17e-4bdc-4e7f-9c69-44d6b6f0fed1", "comment": "Malware payload", "value": "3a192394f81bc87cb32bb39003d17187792720e5d472dfbf5333ccfd4167f92640c3d3abd7c486be2a8640775dc7bc7d", "object_relation": "sha3-384", "Tag": [ { "name": "Moriya", "colour": "#694164", "exportable": true, "hide_tag": false }, { "name": "NtRootKit", "colour": "#140600", "exportable": true, "hide_tag": false }, { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620361021, "uuid": "4b5f915d-6f13-4598-b6ed-8090b6970c07", "value": "59722A75A35510EEE66A81F887DB0D76CEB0F86063218ACF06A1C1D60F43FE5A63E345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620361021, "uuid": "f11bf2a0-df87-492e-8bea-19faf623f533", "value": "c2a21a67b9d83e00a44ab275f274c7cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620361021, "uuid": "2928616b-233c-4cd2-87d8-5d0c597ea082", "value": "384:Q/RbJ4URzIWi3OQr9wo8fcMj9VicOTSR6tVF4040yhVd+pSnQ:SRl4URji+QriPkMZViXTO6a10tpSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620361021, "uuid": "92c03258-ed8d-4226-9265-44658cedb4a5", "value": 16536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620361021, "uuid": "8251ef9d-8a1a-432a-9e47-45ac44822b48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620361021, "uuid": "ba3e9f45-145f-4dd9-829b-c3345fb9d303", "value": "#rootkit #Moriya 64-bit Driver.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf14bd6b-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407294, "uuid": "2191dd7c-d4fd-44ca-a9c2-ebea00fb92ca", "comment": "Malware payload (Dridex)", "value": "b549a515622d792e8a1712b8b7d7f48a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407294, "uuid": "46cd16f7-d79c-4dfc-af9b-cba57a138de4", "comment": "Malware payload (Dridex)", "value": "3eec0949fa5853171d5fed1a049bc8678e07022c92db5ec635dce5a2bf0e8a91", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407294, "uuid": "ed758f0e-b540-4de5-b417-9682103d24f9", "comment": "Malware payload (Dridex)", "value": "ca901365dd6e10bad64a3337fcdfd47f01a4f7ac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407294, "uuid": "ec813d0e-5138-4afa-adfd-b2d481a1e018", "comment": "Malware payload (Dridex)", "value": "fe7ddee1638ed409968674e69a5e70c966051acc46343d715ea04f5bb5ed492d500a8651ceeae9bf039b801b28dac66c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407294, "uuid": "22eb8393-37eb-4c04-84c3-132f4bbd1165", "value": "C9F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407294, "uuid": "30111282-c8d2-444a-9aee-57764c7b924c", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407294, "uuid": "439dc153-8f45-4bc5-ba5f-fa832546aa03", "value": "3072:PBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHC/:ZuXLcclWEc2HeSjNjGdei/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407294, "uuid": "b006bbba-c5ad-4fbc-a689-247e93f0d716", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407294, "uuid": "7e586902-1124-4abe-a76b-d7d4cbbc247f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407294, "uuid": "f9e00832-1363-4891-8f63-3301df3ec2ea", "value": "b549a515_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd06ae02-aef3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620364797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364797, "uuid": "2a90980d-c231-4222-993c-bac788a2d2e1", "comment": "Malware payload (AgentTesla)", "value": "8f1d3b0ef919775f563e4c6fe4cc2f91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364797, "uuid": "b3a54254-234b-4713-9500-a5ab1f9c409d", "comment": "Malware payload (AgentTesla)", "value": "3f21c1dadbb99df098bc46b886abcd6d8e9d4093e9283f6bf9de185a2446dddf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364797, "uuid": "b4bd3a0e-d5b9-4b92-bcbf-bcaad7a187ee", "comment": "Malware payload (AgentTesla)", "value": "91f937d66483cf090eba127db2dd5755b3e363e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364797, "uuid": "ad619e72-9180-4afd-8f3b-3f6015fbd75f", "comment": "Malware payload (AgentTesla)", "value": "e3b668df484077a9d347fef4d85db023f6471c1c1b398f975ba8df05f39e47a1b6ed9416704e9e28c975ddbcf1f33c84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364797, "uuid": "d03cf935-65ca-458c-b5dc-940586c2f29f", "value": "02D4238FFE40081081D976883675735A2DEC26D57BFF04F75026CA3AC35641EABAAD4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364797, "uuid": "725042f4-85b9-41ff-8717-7a198a3dc6fb", "value": "12288:94At9x1/RzXbKa01IHM/9M8BBSobfZ6cMZXUSrwVbNAhngXPKrw0AFS74fsz:94A3x/LKz1IHo97OkfZ6cMxs1ehnzs0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364797, "uuid": "047f379a-1220-40c4-aff7-4f06993e01ce", "value": 620702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364797, "uuid": "5fd207e3-0a87-4729-b709-6dde79e44939", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364797, "uuid": "4ca709d7-bca6-4d27-af37-0cae3216a08e", "value": "PMSHIPPING DOCUMENT & PL.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f33a3d-aefe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620369402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369402, "uuid": "c4c44109-107c-4c10-9e32-f317fa813336", "comment": "Malware payload (Formbook)", "value": "fdb13566001939b797325265bc1048e0", "object_relation": "md5", "Tag": [ { "name": "4.1", "colour": "#DBF442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369402, "uuid": "a34dc39c-8c9c-4579-beb0-bd0f0fb03e7f", "comment": "Malware payload (Formbook)", "value": "3f2cdc7783014a37d7ad61ee00c226d5221d4932f4113eb3590a9c9d0447b461", "object_relation": "sha256", "Tag": [ { "name": "4.1", "colour": "#DBF442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369402, "uuid": "76ff7f67-7cc2-46b0-b453-7644f530cfc8", "comment": "Malware payload (Formbook)", "value": "096a63354f73bcc105030ede2f04c5bb12cf2711", "object_relation": "sha1", "Tag": [ { "name": "4.1", "colour": "#DBF442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369402, "uuid": "631ce6f4-099c-4ad6-9ede-fd4fa85d0bce", "comment": "Malware payload (Formbook)", "value": "40c18171a713d5ef4b4ba40ff0027090d501f882416046c6f776a80460d846169838fe3b53adfaefb84561c6de9ed99e", "object_relation": "sha3-384", "Tag": [ { "name": "4.1", "colour": "#DBF442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620369402, "uuid": "4c6b6439-fa4f-4171-a3f4-dc1e68d3219c", "value": "1E54D0477A1C93AEE38A47B2387A43718B88DF9316206E06FBD5FD6E043125D6E1B1D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620369402, "uuid": "46217e20-e139-4368-b492-c2efa5041926", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620369402, "uuid": "2b0a1279-ee6b-468b-b6d4-e83df200e0eb", "value": "6144:29X0G67TkvW6c5HFMFwXBNSGAfU1NqNSz+vyqytRFT:40FTkq5lxjSsqNSM+zt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620369402, "uuid": "dec72eeb-db79-4e0a-9031-9f29b0548573", "value": 284287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620369402, "uuid": "31fbf3de-a099-4108-bba9-a0a5834ea46d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620369402, "uuid": "7de81257-e914-49ec-91bf-9085bd23cb24", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd7bf7b-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620385280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385280, "uuid": "6af2d5cf-fc6e-4593-96c0-e3becc550631", "comment": "Malware payload (Dridex)", "value": "3a46f4794c55779e9496a492fb5bbd92", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385280, "uuid": "21463db1-ca10-4f36-b873-557cbe6cab65", "comment": "Malware payload (Dridex)", "value": "3f5ac4704875ff009d60342b3cd8d15d3e8f36aef3c825cc8e80828ba5c7a2fc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385280, "uuid": "5bbe7152-9cd0-4c8c-a133-c8fc96901f60", "comment": "Malware payload (Dridex)", "value": "de879643bc6ec0679ec7ebdcb1771c8bc5d0018c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385280, "uuid": "60234c01-d04a-4f64-891e-c9a8d82e610e", "comment": "Malware payload (Dridex)", "value": "393ff88571a280c525617462d608a091a226f0cd0633c5bb7f6df290088a44c2f581a53e49b51669f505b17fc6458d7a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385280, "uuid": "501f4670-70f7-468a-94ef-fce28869dc49", "value": "5AF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385280, "uuid": "c38e7e36-a228-4ae8-b483-4d4b159d58d9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385280, "uuid": "d88b1efc-b700-4086-9172-8a212796bafb", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385280, "uuid": "c2464a74-fd06-458e-97a0-588e5e2fc172", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385280, "uuid": "6c4f83c7-747b-44b7-9d46-6278a432741e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385280, "uuid": "cfeb0615-f01e-4c9e-abb3-5a212886da66", "value": "3a46f479_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ebb1f8-af86-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620427619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620427619, "uuid": "06c8792f-141d-40b9-8811-d9354b05bf09", "comment": "Malware payload", "value": "5ef13eda3820a3d1a1ce94e1b4df14ae", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620427619, "uuid": "d0d6da56-6ddb-4f4e-be19-20a3340c867a", "comment": "Malware payload", "value": "3f5ca9c142356aa91391514a2655ca41fb45f715ebda007731cc08a4b1368243", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620427619, "uuid": "9cbd57b6-ab36-4233-9bca-93eb0e1bf7b1", "comment": "Malware payload", "value": "01f4b90876cc7f417bd8f0776c7b1dc4f066ad14", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620427619, "uuid": "5cb2a6b3-2a3e-42a5-9379-79ce300dad37", "comment": "Malware payload", "value": "77da40391837595d794bc196b95a8ffc1666160f2e5e082cd08781826bb1a63acc02361a3a16288ef7a252a3afda86e6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620427619, "uuid": "5f43bd73-f3a3-4e6e-89c0-df083cd5c72b", "value": "95E533AD27C20405C4C75E79A140A64BE8F74E0E53F3EB9CB9774A789BC6D46ADC2207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620427619, "uuid": "4a1eb3b8-a4d0-460d-a220-2d8731e9c6d3", "value": "49152:Mv1Ec+CGREw4WHH6ZcUlBt5h6VvepbcQjzP+7fbpKcnXsbxYKA+1wLc3LrEuhmQs:K+CYeLpZLnW7fxclYQ1kc3Llhme4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620427619, "uuid": "73301cf8-b04d-4205-8992-f0445321b9b5", "value": 3039122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620427619, "uuid": "b938c550-cbe2-49c2-afb0-097b7a8d62e1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620427619, "uuid": "58c8a8e6-5d2b-45e8-92b5-9944e7d22224", "value": "SecuriteInfo.com.VB.Trojan.Valyria.4579.18506.1949", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b861e848-af11-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620377620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377620, "uuid": "fbcc4661-9624-4117-aef3-6ded5aa81b3c", "comment": "Malware payload (AgentTesla)", "value": "8d89522b63db65e15e2d921e7009b514", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377620, "uuid": "634e6445-35de-4069-b24b-52a6b029221f", "comment": "Malware payload (AgentTesla)", "value": "3f9cec82be5dc83b2fe2570a5948888c39f606f990830edb298f993b79977242", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377620, "uuid": "2bb43497-dad7-478c-be8c-6541637d86a3", "comment": "Malware payload (AgentTesla)", "value": "ae3976e8c1fd8e70b0a5d9671e12861ea612e93f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377620, "uuid": "0055f1b9-1276-4394-b0c0-75856aa11fab", "comment": "Malware payload (AgentTesla)", "value": "d19cf27a2511f6ef461c6e121bfce0922732f21a731f29a3dfa934915ba92473d3d366a1ec12c939b88a05e524eb28c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377620, "uuid": "ab6d5dcc-f9ae-4834-b87c-4aa53fb79f5f", "value": "9F55A1AC361031EEC577C6E69BD92C64E620317A532F4107962313F99A8DE97EF244E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377620, "uuid": "63672cdf-7eb3-42fe-87a1-7d8876036845", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377620, "uuid": "5662fbc6-2f1e-4753-943c-051e555c3586", "value": "24576:Dj7fpKK1oLAzW9V62rh8/4uia7OoGszGV:/jpKpMO5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620377620, "uuid": "9ed57538-bd8e-4781-b57f-c2906ec13353", "value": 1342976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620377620, "uuid": "d43c35fa-3a74-4ea2-a32d-4885b287fe50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377620, "uuid": "162cb751-b3c3-4f83-85db-475e2134ca5b", "value": "FACTURA 6475.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00e700f-aef2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620364399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364399, "uuid": "5b635f85-b0cc-4974-9ba3-8819b3bf5271", "comment": "Malware payload", "value": "1ad4a95949bcea5fc59d635f020e39fc", "object_relation": "md5", "Tag": [ { "name": "Lotok", "colour": "#7D963E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364399, "uuid": "fe8a3b5d-dd2e-41a0-8da4-a13e588fe3f0", "comment": "Malware payload", "value": "4021b25dc6a32dc9157ee22bcf818f9eca8fe0d304ab1b436ea71eefbff92920", "object_relation": "sha256", "Tag": [ { "name": "Lotok", "colour": "#7D963E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364399, "uuid": "9f8169da-1d7f-45b1-a044-10527e718b31", "comment": "Malware payload", "value": "60d6ffd37ce2642ea8699cb0d13e940e4c08619f", "object_relation": "sha1", "Tag": [ { "name": "Lotok", "colour": "#7D963E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364399, "uuid": "27e412fe-4fdf-4f22-8555-87de0d8f42ba", "comment": "Malware payload", "value": "a226ef9cf7d1df195213e7f119941f78e9368950717a8bb1c9d46fcf3487af927717421ca1bd3770c1b7b6f59e8f1844", "object_relation": "sha3-384", "Tag": [ { "name": "Lotok", "colour": "#7D963E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364399, "uuid": "2446f2e8-665f-42a6-9dad-63095fdc5df4", "value": "D0E2D0EAE2FD7C48C2B52B39DD63670D1811EC216686577F1EC0312AED637387C28529", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364399, "uuid": "bd6d7001-9d30-4ee8-b6ed-7b582dcb356c", "value": "3d2b95b998469ac775106242f347c0e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364399, "uuid": "fa42e859-db0c-44f1-b68a-2561fba11deb", "value": "768:5w/iOWTK3JWhOM/qZh7UJGcZ/0YKU1plnbcuyD7Urs9:CQK52fqZSIAcvU1plnouy8rs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364399, "uuid": "dd942590-05e8-40c2-97a1-6ae64cf13f73", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364399, "uuid": "17a7b49f-c5cb-43d9-8e94-bf3b3d81b08f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364399, "uuid": "4e373326-3192-468d-934b-9be5ea8cedbd", "value": "446.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f34738-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407176, "uuid": "480de7b9-7062-49e9-a427-5340d9794607", "comment": "Malware payload (Dridex)", "value": "0f54132ced6e2dc75e879c25e3423436", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407176, "uuid": "10b3f77f-af19-461f-a02e-d63e9bfe0b41", "comment": "Malware payload (Dridex)", "value": "4038b6d28e69203c04287d1861cdb02ee456bcb37d9632eaa5a14641ecbb8a7c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407176, "uuid": "1429b0ba-bd2d-495b-9107-8a616786a32b", "comment": "Malware payload (Dridex)", "value": "eaf91b42622967c968a86d474d0c0d0542e2b547", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407176, "uuid": "c8f5f6cc-e92f-4917-8725-67d75f9b2e96", "comment": "Malware payload (Dridex)", "value": "9b9d0de085e481e7fe2131eb3811a2bc09441e37ee13914347c334be7d55e3de2d7620a74d99db6ee63436b720884544", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407176, "uuid": "7a62b270-c5c3-44ef-a6d5-19894c27a2af", "value": "F8F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407176, "uuid": "a5073fce-65e7-4c0f-bcc4-2952414b0633", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407176, "uuid": "a82184f2-4574-4616-802f-36c69b34b4ca", "value": "3072:1BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:7uXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407176, "uuid": "c6523f4b-8d05-4fea-976c-f4230a635a1c", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407176, "uuid": "1cf003f2-dc03-485f-81c9-004ce4fc4c11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407176, "uuid": "9e7b744a-b575-4434-a8e9-6a50592e4826", "value": "0f54132c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11e968f-aecd-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620348429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620348429, "uuid": "d1ccaf54-2b6f-4595-ad2b-64d1abdfb076", "comment": "Malware payload (ArkeiStealer)", "value": "eeb3013d6229a55fa47c9f546f3f7060", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620348429, "uuid": "478df424-57aa-4985-a5ea-e414846b498b", "comment": "Malware payload (ArkeiStealer)", "value": "406bab33444def7d1d848e16bcfb2c5a7891910a4244a66b6a4d1ebbe0b5f00c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620348429, "uuid": "e2531c37-3b23-4958-9f61-3166ba02bd89", "comment": "Malware payload (ArkeiStealer)", "value": "e0142347386c3fdfa6bdad8df7c4238a278f1d3b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620348429, "uuid": "3b409693-ca9b-424d-80a4-edf0ead058b6", "comment": "Malware payload (ArkeiStealer)", "value": "9c6cb67572016846a9f13294ec7f80a03cd2e043fc2ee86be44b101afb0b14f9a6e515eb573a355dfebf31d7530d2ebe", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620348429, "uuid": "b795807f-22c1-48c0-a73a-8c02480820ed", "value": "CFD4E030B6A0C0B5F4B711F448BE8EFC75EA7DA04B3059CB52D53AEA1A346E4AC31657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620348429, "uuid": "04c80257-d404-4453-8f2d-9130836a0c9d", "value": "ca69c6b93092b0d48acb97177d0397e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620348429, "uuid": "c1372dc6-0249-4d41-ab1a-bb09be5f084b", "value": "12288:jKAUbfzyrrwjw3qQBdBwTl40lBjxUobzSlFuSD1i+yaGQoGV24/:jqbfc7TBglT/S5D37GSV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620348429, "uuid": "63f79b6b-d1b0-4de5-8a9b-c64b202d0591", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620348429, "uuid": "a3647027-ed59-496e-b2d1-a837a8a21f96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620348429, "uuid": "32f5b35b-41b8-49d9-9d43-c6384d78d29d", "value": "eeb3013d6229a55fa47c9f546f3f7060.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182af128-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403980, "uuid": "fd61cf5b-797e-4e60-a410-e50e81b03547", "comment": "Malware payload (Dridex)", "value": "33cbcec39faec79fbd727cf8a29f235d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403980, "uuid": "348f78e5-3b88-4d71-8828-cbab1bbdd8a3", "comment": "Malware payload (Dridex)", "value": "4086f9dbd925d216d3475b6f740caa05697d4cbee900dae7b2ff7aabb204856a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403980, "uuid": "af4eed60-1296-42c8-aa67-980840ab7d2d", "comment": "Malware payload (Dridex)", "value": "da1d6c767cb28fb02e382c4f61596e5098f0ef46", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403980, "uuid": "a3fe75d9-c326-4df5-b45f-b01b85350427", "comment": "Malware payload (Dridex)", "value": "fd0473fa353165eb6c0e3695562a4090befad5c4923eb2405cbcd30c2eb9f2cab2b004d6bfaaa6bc4ff3d7a9fdb762bc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403980, "uuid": "72b6f7a9-0b57-40b3-bbf5-c48de978a23f", "value": "B0F3C141C9C5CCF0CBE36C3A4695963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403980, "uuid": "c4f3603a-bd1b-40ca-a310-bc429f6befa2", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403980, "uuid": "fc70b256-53ca-4188-b357-b4c5f3a83f6c", "value": "3072:nuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+0Hl:n0czbty9uiaJlhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403980, "uuid": "ceaaed7d-1fce-4a09-94e2-19d09f4250bf", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403980, "uuid": "8540f322-31f2-4bb2-be0f-520754afe18d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403980, "uuid": "4811e57d-9022-468f-b2bf-8b3740edf06d", "value": "33cbcec3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca20971a-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620414157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414157, "uuid": "da3cbbca-6799-4c2b-937f-1de17701b52f", "comment": "Malware payload (Dridex)", "value": "c84cff82aaf941dc3c85f93403eb8fce", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414157, "uuid": "ec84c5ab-4cc4-453c-89a8-519401ca0a54", "comment": "Malware payload (Dridex)", "value": "40ab729c324ccf7cc5d34f635fe14f01c9fe72cd5d1e30348a33678408289d4f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414157, "uuid": "515731f5-78dd-42f4-bd0e-b3c5974eff36", "comment": "Malware payload (Dridex)", "value": "5646139192dae539f3d73a5ea1d1d9c37f9feb9f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414157, "uuid": "0339300f-8a15-4fe0-aab3-3c9c6350da01", "comment": "Malware payload (Dridex)", "value": "3dede4c532ae265135f426f2f76afd1331b85be7b79a4729eb86b752fa89f519329138ef8c223ebd74696c0bae0c2866", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414157, "uuid": "c53ccb0b-36e0-473d-96ac-d4efbc7b0932", "value": "26F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414157, "uuid": "60fcd542-3188-4d70-afb1-de324db52f1c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414157, "uuid": "50ccccc9-0c78-4835-99f5-2eeb9f1e9cb7", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414157, "uuid": "7e3ad613-4bd7-4bcc-a9f7-1b0b4855796e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414157, "uuid": "6a092cef-21f5-4a04-b0a1-80410ded0018", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414157, "uuid": "14717409-fd01-4dae-9013-d75c4e3821c9", "value": "c84cff82_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a23e4d8-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620385300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385300, "uuid": "0bdcfac2-049f-461f-9178-7a4856f03f59", "comment": "Malware payload (Dridex)", "value": "6a1592c3934a6bd195fb5936781373f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385300, "uuid": "7c25fd3f-bc43-4ec9-bac1-ba1f8935b57f", "comment": "Malware payload (Dridex)", "value": "414ca348782892d05a2b70c448f5248d993e9f8dc39e6e74d45874a874870695", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385300, "uuid": "4ad972b8-22bc-48f8-9113-60a3a6aa0535", "comment": "Malware payload (Dridex)", "value": "9f072f144936daf5daad0fa2947d2a832ca961ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385300, "uuid": "330c2e2f-3734-4079-b08b-b4bfaae0f2d7", "comment": "Malware payload (Dridex)", "value": "25479f194708492f735cb2826b78f3cf8b0b1522c43495281b658d0177db9c4342699a25647ac24b7d474f7af5a57c03", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385300, "uuid": "e08bbe79-4bf0-4596-9adf-9bc12ab84af4", "value": "9FF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385300, "uuid": "65fdc181-8e82-4b4b-b601-6d18267bd117", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385300, "uuid": "fde6dcd8-9fab-4111-a156-d571d545a171", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385300, "uuid": "ee2bbaaa-b6bf-4206-972e-20a20602ca11", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385300, "uuid": "4a953c18-fc00-4450-855d-e83bac0cc9d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385300, "uuid": "d91f3284-ff7b-4262-b3f7-222f8fc32b60", "value": "6a1592c3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22553570-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403997, "uuid": "c77bfd0d-7ad3-420f-bb18-8da53f154ff4", "comment": "Malware payload (Dridex)", "value": "26208e135450424f20ead3843262c8db", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403997, "uuid": "95e7d3d1-3db7-455f-a2d2-b2ffca415c9a", "comment": "Malware payload (Dridex)", "value": "41a4371f8c3aebeddfcc464174acaf54e0ea025e5c0d26e3ddb10d91e4319089", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403997, "uuid": "44194e20-2ea4-4840-a55d-3706bb21a89c", "comment": "Malware payload (Dridex)", "value": "7b495965de5eeb30096aa969093babd60b520dd5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403997, "uuid": "03ad5f19-f687-4076-bb62-e18c6ef78086", "comment": "Malware payload (Dridex)", "value": "f7ece078c80da62977cb7e85218ce183f8aefdd4ff07261b1677fb4edfb5c0d614b775b093a70d55177664b45938a77e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403997, "uuid": "23f560c3-edb0-4009-aebd-9a5bddca197c", "value": "84F3D081E7CED5E0FC179B323EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403997, "uuid": "3d25d1a8-f851-46fb-b5c2-a50a241c5e6c", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403997, "uuid": "c76ac83c-dbc5-4ff3-ac32-a8212a066719", "value": "3072:SBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHaH:yuXLcclWEc2HeSjNjGde6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403997, "uuid": "df2b1b00-aa9c-4f7c-af97-b98af0aeb0e4", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403997, "uuid": "523d8a07-0050-40b1-b4d3-5c7cfff3bd22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403997, "uuid": "215d1afa-80a8-4168-a0a5-1a89739511b4", "value": "26208e13_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b48de57e-af2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620389640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389640, "uuid": "b4f76dcc-e7ff-4718-9aaf-5d4ad254410b", "comment": "Malware payload (AgentTesla)", "value": "845e5449b1cbcda129921bc273b38955", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389640, "uuid": "165d40a4-5f08-4417-9f9b-eb1a024c8b40", "comment": "Malware payload (AgentTesla)", "value": "41e349119b9a1aebc063485f05b1110c7f4f6524560dff0dd7f2b832b544261b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389640, "uuid": "6ca812d7-c718-4527-a820-2aab47f141af", "comment": "Malware payload (AgentTesla)", "value": "a19eb44b6045f0b3b4522f0894a4c68b523949e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389640, "uuid": "fabce54f-9d4e-4490-9165-2cb295e4996d", "comment": "Malware payload (AgentTesla)", "value": "6022efc46a63c31cfa915818386855abdfa97c34c790064c33c10c24d9643c2ae917460305b6dc8baf547829662b61d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389640, "uuid": "436dcad2-d543-4c04-af5a-b1587d383ad6", "value": "DAE423474D278C3608BE8F194BB73DCCE8A9910419D7369B733313AE63C57209AA775A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389640, "uuid": "9acd668e-d61d-4b4e-a86d-d84540185499", "value": "12288:wEGnRLi81tIWECHyY82Nn0hOso5ZDyZas3V2IuhWjZz9aN8ut2smA2FkgYnr:gG81yWECSY7i0D+H3VNuonli2smA2Fkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620389640, "uuid": "6412653e-1281-45cc-a736-766f633c09a5", "value": 665734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620389640, "uuid": "3b3a6aaf-5860-495e-a4aa-e0f0a0a55c25", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389640, "uuid": "c1e7ec79-0dce-41b0-8588-9ddd243625fb", "value": "image002.png@01D4EB98.FAE33E60.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4554cde9-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407492, "uuid": "48b88271-34ad-4916-a7f2-b9de30018799", "comment": "Malware payload (Dridex)", "value": "5d2435522d3cd513b9eac89c7e28f6d4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407492, "uuid": "718686c8-310f-47fb-ae9a-f3924e957318", "comment": "Malware payload (Dridex)", "value": "41f0f02a2db805f3cb82334c601de0d477916d3fb1c43e4c62cf202431fb0a56", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407492, "uuid": "bbd0b287-04c5-4f3c-aa7c-31f0d7b97a88", "comment": "Malware payload (Dridex)", "value": "82f831916b36853a0083e2713a49d885dc3991b9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407492, "uuid": "afa01592-a91e-4ef2-af63-3260d40a2fce", "comment": "Malware payload (Dridex)", "value": "fab4c60f5472fb9cce5c486830eaac2246b27701ee2d6d8c80b3b32a035ab4cb01023f94abcc96e3a752854b8fee284e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407492, "uuid": "82a27a14-8a2e-4556-ba06-9872efd07c0d", "value": "06F3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407492, "uuid": "4648f16f-feee-4a20-96af-082319dca479", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407492, "uuid": "93917a46-e541-4f11-b313-fb6e8daa14d8", "value": "3072:5BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHPD:nuXLcclWEc2HeSjNjGdevD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407492, "uuid": "03f5b540-ca66-43fb-8f69-557391c5d829", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407492, "uuid": "2936e542-4eb9-45a7-a9d1-65d8b7e65d0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407492, "uuid": "8d81b02a-50ff-40a2-b547-16538807065f", "value": "5d243552_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6036a95b-af5e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620410544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410544, "uuid": "8c0173ea-8521-4d4e-a446-a40df54a09b7", "comment": "Malware payload (Dridex)", "value": "35e8bfd683885047d7970cbf1398cefb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410544, "uuid": "158ad13a-1258-4f64-b462-b6f7530eee0b", "comment": "Malware payload (Dridex)", "value": "425ff84e608b8d4c6e06978286bb34c632b4f32a04f0e96fc663832c35c95aba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410544, "uuid": "cc5b651b-bfd5-42df-8f93-c411faefa696", "comment": "Malware payload (Dridex)", "value": "cfeea2042518168b9c16de1679a03201ddcc8a84", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410544, "uuid": "2b14e3c8-b043-43e3-96b2-153f848f998c", "comment": "Malware payload (Dridex)", "value": "0fd2fc947c5bc572ed83d2e18bc5d3472a60f13ffe6ca76cc2a0aa837dc7afd159776f21f4bd4556e183bbdb2e5fd0c3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410544, "uuid": "82a24fce-ee91-428e-9dfb-885552532e3d", "value": "68F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410544, "uuid": "b27ea108-f3fd-4d6a-8336-4d31aece60e7", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410544, "uuid": "07e227f8-dc92-4486-a9ee-3ef9c7262ec9", "value": "3072:NWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:N42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620410544, "uuid": "729e8f4a-764b-4cd4-aaf1-804b2b7fa699", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620410544, "uuid": "681b2646-0bfa-4377-8772-4e267f9cd173", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410544, "uuid": "09e592fa-832a-4988-8fde-9030ab37e9f5", "value": "35e8bfd6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e76b3e3-af24-11eb-abe1-42010a9c0039", "comment": "Malware payload (YoungLotus)", "timestamp": 1620385737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385737, "uuid": "10a624b1-39c9-40a9-89f4-26ebf4d6e672", "comment": "Malware payload (YoungLotus)", "value": "2510bc30669edc05f9aeb06f5c92bed2", "object_relation": "md5", "Tag": [ { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385737, "uuid": "6957145e-723b-4615-9b26-cd74fdf98085", "comment": "Malware payload (YoungLotus)", "value": "428280c60495d98bb323401c877783e641d21f649684fbacbb29bc8067bf6635", "object_relation": "sha256", "Tag": [ { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385737, "uuid": "f9f49537-bf80-4361-aad1-1654b1fc7edf", "comment": "Malware payload (YoungLotus)", "value": "3ac2a1e223d74323c18c9d4788ec3195c382dc64", "object_relation": "sha1", "Tag": [ { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385737, "uuid": "6128b8ef-1272-4d86-86dc-aaba8049a261", "comment": "Malware payload (YoungLotus)", "value": "155c8e26cd3a8408892cddfb882e8ea52e2125ed2e126a64b57fa1260c7f60317617de4a4435222c2749541ae32dc9a3", "object_relation": "sha3-384", "Tag": [ { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385737, "uuid": "181b2b2a-e646-464e-8bc8-53defd92eb34", "value": "A48533030FCC102FEDADE67B561DE44A05DCA5622BE23E50E99A6FC3E4615C91C8CFA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385737, "uuid": "11180d57-db13-41b5-a655-2dd2bd101e7c", "value": "edde0414dac6027c066f48d36f7f81dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385737, "uuid": "b13a9f0c-c993-461a-85dd-ca62d6452f5c", "value": "24576:Ym/35M+nkqL0DvXikGk3dNj6lVn8JitjUV3KZC6BBRlSSqOn7+x7zWvcFoB1:F57GybkTjIugjUV3v6ReLFoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385737, "uuid": "ae34334e-5e3b-400e-b844-7eecb6713396", "value": 1721856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385737, "uuid": "82f99abe-f277-40a1-86dc-e266652ada27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385737, "uuid": "b2141469-1878-4dd4-8695-8e2a876018d1", "value": "64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e87db83-af5e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620410514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410514, "uuid": "ef61e6d8-f606-4198-a9b9-1a858d769851", "comment": "Malware payload (Dridex)", "value": "c5a446038ec5782c6073550a37aad0e3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410514, "uuid": "a21dea9f-fd92-487e-a75d-574d48530d88", "comment": "Malware payload (Dridex)", "value": "42d13cff66cd29366399cbaf3d2cffde8aa21639f0f88efb9d962dcad446c369", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410514, "uuid": "9da56012-04f7-46c9-b8ba-ae64b3c75c43", "comment": "Malware payload (Dridex)", "value": "d21ea1d6f99c3de5a7c58ab00f235a46396c112e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410514, "uuid": "6ec75aec-8269-46bb-8644-b000e606a5ef", "comment": "Malware payload (Dridex)", "value": "bf0cc12ed20c3b6aa7b5aa3f0c291cff8b1569169c88155977d6a341cb5bad07bfdff9202b38bffb2cf20ceb08a550f4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410514, "uuid": "58a4fbf1-d267-4ad6-b021-84db44dcdf48", "value": "8EF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410514, "uuid": "0e51cf6e-40a6-4f50-83ac-fae3af249735", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410514, "uuid": "818068ec-f371-45c7-a370-d3ec88bc5699", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620410514, "uuid": "970318a5-0cbf-4457-8103-5a844190fc75", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620410514, "uuid": "358c9de7-d7d9-4355-98bd-6c2fc62224cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410514, "uuid": "79148832-f569-4d84-959d-30f6622f84db", "value": "c5a44603_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d74147-af02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620370905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370905, "uuid": "a4e767da-27f7-4736-820a-91c202010de6", "comment": "Malware payload (Dridex)", "value": "d5851ff55f0619e1a7effed2851f1997", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370905, "uuid": "990aa44c-a222-4a24-b908-ad663864167a", "comment": "Malware payload (Dridex)", "value": "431d7c5ff9d692a5b52a3d7612cc87e6c986623fbced5a137873b36e6c8d0c98", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370905, "uuid": "f2b6ee4a-05ed-41e5-a23c-f4ef62ed16c9", "comment": "Malware payload (Dridex)", "value": "d8f6485f1fc1d1fc9c3c3e83d8161cf65d83483e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370905, "uuid": "ba6af0e1-0cda-4055-a343-3fb33e34fe60", "comment": "Malware payload (Dridex)", "value": "d6b5f77f1f9372a0bbe17c51c04920d9a41d01554f928a131fb815da0899ea9cef9c997aa2897cb9a9973c48ea1aaaf4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370905, "uuid": "29974216-49d7-4369-a14c-5be69a49e884", "value": "0AF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370905, "uuid": "8405302e-03ea-4e0f-b611-fb5f2e0255bd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370905, "uuid": "dd14fd85-2061-4aa8-92e4-588b03d4e906", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620370905, "uuid": "3c906618-9a22-4af9-b80e-48252d232f1f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620370905, "uuid": "70088374-fee4-4ae6-a659-68b2556aff2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370905, "uuid": "54eca2cc-76f3-44d4-aabb-f42c345393d0", "value": "d5851ff5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e939b7d6-af6e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620417645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417645, "uuid": "37da904f-467c-4d23-b0dd-47a3a48ac4f4", "comment": "Malware payload", "value": "80763a898971c56da33746fdfe9ffe8c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417645, "uuid": "8600ac6c-3b74-4517-bba3-7f9bf94ba155", "comment": "Malware payload", "value": "435180b9f875d58bff175cdc4c542f253b71730fa37f7051972a6f2995b2bb9c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417645, "uuid": "059b2c88-8c73-418d-979b-2401cbbbee19", "comment": "Malware payload", "value": "37b0cb3e8a088e98719d09222374e54c19304694", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417645, "uuid": "569e5d9a-5aa6-44ba-a527-28248d2ba46a", "comment": "Malware payload", "value": "6fdc9ec279f940d3e32dab031a25839754a3cda53a6689b55c044d454b828038629fdff0a15a0ffc619e510cfd1e8ef1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417645, "uuid": "90c20ea8-58be-4bb7-af26-ddd7e843941d", "value": "91F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417645, "uuid": "0dfddce9-e984-4890-a7db-a918d82b0963", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417645, "uuid": "fa51231b-7a71-477b-9019-6f8c404f69f7", "value": "3072:flpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:flo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620417645, "uuid": "db858c4b-96c6-4a46-93be-b909ca8dbf91", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620417645, "uuid": "01762ebe-c28a-4e7f-bfa8-38902a4a2ce1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417645, "uuid": "75eebadb-0b6e-4732-9c56-e7775a952754", "value": "80763a89_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47f2ce6-aefb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620368138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620368138, "uuid": "b845bf6a-8e1a-4cbb-bbab-50cab307ad6a", "comment": "Malware payload (IcedID)", "value": "ca59f54a3c5ab7ab707c7bd266afedea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620368138, "uuid": "b9a850e9-35c7-43ae-a816-cc94014b1261", "comment": "Malware payload (IcedID)", "value": "43557e1330e200583d0d833b7e18d7e708a3c0c2c36fe36dfec079ac3338676f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620368138, "uuid": "adcc26d9-f3b0-44d4-ac5d-c2ca1339c8a2", "comment": "Malware payload (IcedID)", "value": "0e1c6dc17ec72f269ee3b2602d99d024184b47d6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620368138, "uuid": "f2aa723b-90c6-4fa9-966f-5b7152b079a4", "comment": "Malware payload (IcedID)", "value": "588a50fa5428c8d059fd833345c9d170db4745d37878b865a2b5b61908f1afc364bd7048538f62e86cf7000a46783b5f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620368138, "uuid": "a11691fb-50cb-432a-a04b-d7255f53e211", "value": "82347127C5ACE17DF64754F1343CEB89C544AE80AE118DD7A6C6D812AF139F123227EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620368138, "uuid": "63f988dd-eb43-40b0-8184-5c25374be929", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620368138, "uuid": "1c74ea3a-4b65-4c49-983e-9e74e7edacc9", "value": "6144:6Ax88XNHffIYjh6QRdk7fodX67o8ck+EdB7vMqRtT:d88XNHffIY4TBoJqR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620368138, "uuid": "2441d23e-72cd-45b1-98b6-78a6735e58df", "value": 237144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620368138, "uuid": "c8621ed3-f4b2-4beb-b988-c97f35819136", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620368138, "uuid": "405b02e6-407c-4f2b-8085-c284324e4ed7", "value": "43557e1330e200583d0d833b7e18d7e708a3c0c2c36fe.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3208b7-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403373, "uuid": "4b400988-1850-4303-954c-a5ad26cd78c2", "comment": "Malware payload (Dridex)", "value": "44a4aabd7853076f6369db72bc1acac9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403373, "uuid": "97530aea-8f8b-41b8-a867-a5075686f2b6", "comment": "Malware payload (Dridex)", "value": "435fdea9b2f67d3ddc867bca01c6a221496832e4d853b6fee4e791a0d157303f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403373, "uuid": "f8c6fa57-10de-48c7-8cc3-3194c748dc89", "comment": "Malware payload (Dridex)", "value": "88f87aff3b479a223159defffc32c3639adc5f9f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403373, "uuid": "c9e25629-fa7c-4f68-be50-99cc879942e5", "comment": "Malware payload (Dridex)", "value": "4c509f24bd4a55437b467069b3b6887d119de4e3a81706b3af7fc17190f6a4e04c586ca2461aaa9d7cfb99d2107e576a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403373, "uuid": "dc64a4b4-caf1-4751-9b3b-349129402b5f", "value": "FAF3D081E7CED5E0FC079B333EA80EEF52310087691854E4EF29DABD96BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403373, "uuid": "b69f8911-2862-4eb4-9c89-74780223d67c", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403373, "uuid": "b8e07bde-86ee-4aa1-92e7-1ca3c7356358", "value": "3072:dBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHit:TuXLcclWEc2HeSjNjGdeCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403373, "uuid": "5792127a-d50b-40e0-9149-c0ffb3a839c6", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403373, "uuid": "f02c7dd9-ccc1-4a21-855a-06704133f0bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403373, "uuid": "e8698090-07bf-48c9-aa47-3391a86f4923", "value": "44a4aabd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6cae04-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404071, "uuid": "70613c99-816b-446d-a4b7-20d4b286dfff", "comment": "Malware payload (Dridex)", "value": "0ff5236493c990c785629daad0971792", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404071, "uuid": "a1de0bb2-e02e-47e6-9aa7-3822fef6c18f", "comment": "Malware payload (Dridex)", "value": "43b51a04b67f84015752f5d2f2bb4d03eaa1abb987d19bf7911e37a115eb9078", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404071, "uuid": "705e4965-5610-4efe-ad66-97877860d8cd", "comment": "Malware payload (Dridex)", "value": "18abac1336f53340550fc0bc3794a8c0902ef2ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404071, "uuid": "51714677-df5c-42c8-ada0-cb6214445093", "comment": "Malware payload (Dridex)", "value": "0a0f1e3a7435046946828341c16e2ca29007afe89424146e8b4dc73e80bed3d1f6d3b35a855f48f073a079daf16a22b0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404071, "uuid": "342e76c1-e374-4bc4-be99-661d331bbeb4", "value": "98F3D141C9C5CCE0CBF36C3A4795963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404071, "uuid": "1193d24c-ab6b-47bd-b67e-c9a005ad509c", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404071, "uuid": "d21f60f3-6485-44b5-bb79-17f1f1ad09fc", "value": "3072:nuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+zG:n0czbty9uiaJlyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404071, "uuid": "824b57a1-f3eb-427f-a213-f46143796900", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404071, "uuid": "72efcb41-e8b0-418b-9fc8-9037044689dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404071, "uuid": "caeadc62-0a71-4097-b4b2-bf2ee71ece66", "value": "0ff52364_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7f51ff-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407319, "uuid": "1648948f-8e92-4691-8a32-ebc85bdea161", "comment": "Malware payload (Dridex)", "value": "7adc3be9519745d9575983acaa5d63d9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407319, "uuid": "fe047c47-34e8-48f2-a538-18a7a91cd520", "comment": "Malware payload (Dridex)", "value": "43c7f74ddda04cc698dcb60f33e0b75b5a8b49540f0781f117acaf1e29b46a44", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407319, "uuid": "7407f4dc-e6fa-4348-a88c-ec1bc3fa8508", "comment": "Malware payload (Dridex)", "value": "e8d2e755eace4b917c9254884e4c7c0309269cbc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407319, "uuid": "9207b39d-e4f7-4c65-a146-322c292dd2c4", "comment": "Malware payload (Dridex)", "value": "4a01c8c337fdb1af7d3a07d7fc82a0659b6faca6e9fc8bac26867339950c6320e80b902e5e4ae9bf0fd3a3e42be32377", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407319, "uuid": "1b51d72a-563f-4e7e-92c1-a51f51fcca5e", "value": "8DF3D081E78ED5E0FC075B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407319, "uuid": "946c0729-53a1-481b-81f7-1f48be4e7d15", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407319, "uuid": "68461175-838c-4c1a-8583-a9c09ab723c4", "value": "3072:sBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjf:YuXLcclWEc2HeSjNjGdeDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407319, "uuid": "a2c7deac-4338-44bc-a283-45ef90a4526f", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407319, "uuid": "9cd0688e-34e1-439e-b80f-9b354310748e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407319, "uuid": "26b1c7e6-9f88-4af2-9496-5ad30596c197", "value": "7adc3be9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c66d9584-af7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620424888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424888, "uuid": "8af2bfa8-23e6-4e56-8cac-7977389ba467", "comment": "Malware payload (Dridex)", "value": "993de47344bf18a71ab0c734dadbc7eb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424888, "uuid": "411bf445-99f1-4089-9b45-db45c45789c5", "comment": "Malware payload (Dridex)", "value": "4414066ea13e8ef1fd2aecbdb71877cec124c81458a109d838bae65f4852967b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424888, "uuid": "3d604efc-5e2a-4159-881d-4dd56e9b142b", "comment": "Malware payload (Dridex)", "value": "873dbeb0779418064620791187d66d3df211d387", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424888, "uuid": "a0f05081-9787-4469-8eb6-cb34e2f080b4", "comment": "Malware payload (Dridex)", "value": "38e9ef769c01790ade509e5a6e877a00a2e68b9180f79ae1388ffb732c54639bf0d5a01c797c9b8b2f1ae24a2fc95092", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424888, "uuid": "b5909eab-e1c2-492d-80d7-c3995285106a", "value": "6CF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424888, "uuid": "d2f0c7ff-c5c6-4870-82f5-e089ebbd4a7f", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424888, "uuid": "ffc7a9f0-7cc6-4ae2-922b-16e667420503", "value": "3072:ciFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:/eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620424888, "uuid": "a35ca1e0-e016-4fb1-b547-072f6cdab60c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620424888, "uuid": "701805b1-d4e0-4bdb-9178-5e03ffd9d1d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424888, "uuid": "9c9a12e8-5162-4309-a957-e05eafd1d9a1", "value": "993de473_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cda7f43-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404042, "uuid": "1b53cdcd-0f3e-46e0-918b-b1a350beff31", "comment": "Malware payload (Dridex)", "value": "d6d388428d40b446a86c0b250aa95174", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404042, "uuid": "26b8e292-c940-4ae1-8c78-4603d71814ab", "comment": "Malware payload (Dridex)", "value": "442272ac3039149618208b911d5c0fe8d9df11ec0c55236131693c18b1d2b95d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404042, "uuid": "2e0d6faf-4c2b-42b3-aead-1af7a1411b0d", "comment": "Malware payload (Dridex)", "value": "4a5744a32c3db35c75b899813517394fc050bdc3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404042, "uuid": "e1651417-1fa5-47e7-88a5-f00a3a06c52b", "comment": "Malware payload (Dridex)", "value": "46bcd54a5aaef5e657eb82f1e4a3fbec0f13ef41f215c5377946166982f77fb60a8e2dbe633c89e6cecf7f379f00f2d2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404042, "uuid": "85c6bc18-11ad-4284-8377-99a3c8f31009", "value": "6EF3D081E7CED5E0FC179B323EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404042, "uuid": "a6586eca-2af0-4b0a-9b59-5de45b9a2902", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404042, "uuid": "0218eab3-7b75-4fd7-a49e-33bfd0bef28b", "value": "3072:cBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHaH:ouXLcclWEc2HeSjNjGde6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404042, "uuid": "5439f5d8-3da5-403c-b5c9-3a2d489a72fc", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404042, "uuid": "c9b37eec-350e-4df3-865c-d3bba352e524", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404042, "uuid": "f5ce8aba-4ffe-41fe-9ec2-1bde202f6234", "value": "d6d38842_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9ef969-af3e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620396685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396685, "uuid": "0d9b2f43-8de6-4864-b9c6-94539944881d", "comment": "Malware payload", "value": "7c8a978b7ef8438dbe82802282bf15dc", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396685, "uuid": "b86fcbda-a158-407c-a772-3cc52637df11", "comment": "Malware payload", "value": "445d6566bd3935800306184df6264cac7ea48799d1cc21f60c7f2380419f6353", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396685, "uuid": "bf5f7d10-367d-4f89-b4cd-c929ffb0f236", "comment": "Malware payload", "value": "d193a53bb2958e3e27026c80cc2110a223fc82bd", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396685, "uuid": "77439145-9436-4a4c-9485-7887bd02faa3", "comment": "Malware payload", "value": "635554d7575b32173ab950626e9130492807eb00622c68136b7919a7318543f57dea616cf04559ca97004860d9c2aa40", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396685, "uuid": "8189fb85-075c-444d-8be0-66e59e52db66", "value": "E041E4C8198157782DD9DA3BBDB80566F7C094B2B4F8BE08C8DC7DF8A48DD481258743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396685, "uuid": "053e826d-a889-442c-a7aa-2cf25d2da955", "value": "48:vKMbKBfKCxgKvKkPKGUaKxPKDtBKw1KShxpKh/K33Kr/K3s:vKMbKBfKUBvKkPKGJKxPKDHKw1KSvpKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620396685, "uuid": "74cdce08-5bf3-4b24-a462-175139400bef", "value": 2253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620396685, "uuid": "bbf074d5-c8b6-4ea1-8c0d-5bc56ff1ded2", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396685, "uuid": "9a26d5ad-ff71-42c7-a0ea-cff71b39fbf6", "value": "445d6566bd3935800306184df6264cac7ea48799d1cc21f60c7f2380419f6353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b9330c-aecb-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620347548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620347548, "uuid": "50fb1e56-c73e-4466-8e3a-d654e20fefc9", "comment": "Malware payload (ArkeiStealer)", "value": "09706a2a5b49051e7faeb7f37c7a3716", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620347548, "uuid": "8d6554a1-ed57-4b19-8a20-f9443af31198", "comment": "Malware payload (ArkeiStealer)", "value": "44bf88068988875d253a1a9f22305b37e866a3ccf1fb67c4f7a3ef25ad3107bc", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620347548, "uuid": "196f26a3-299f-4ddd-9f1d-f3ccb3910f1b", "comment": "Malware payload (ArkeiStealer)", "value": "15dd3de96a3fa0b8d192669a5fc0e66db8125db1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620347548, "uuid": "0c3e7cd0-bc61-45ef-8095-f8260e0548f5", "comment": "Malware payload (ArkeiStealer)", "value": "dfe4f57fcd8c58774b9dc15add6360e2657852399e56f799cc471bef822d3199d265796472006d4288024b84847b1638", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620347548, "uuid": "5d7fa774-f462-4947-95c4-2833f9664787", "value": "42D4F1F0B590C037E4B712F858B683B9652C3EA35B3480DB62D53AEA16346E4ED31767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620347548, "uuid": "27253571-b919-405e-bd49-2a4b1893dddb", "value": "ca69c6b93092b0d48acb97177d0397e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620347548, "uuid": "1eb45c1d-bcfa-4f3f-895e-2b50d2435099", "value": "12288:OovByfUv7fE/PIkQveXCu30Mz04F8/ab40F5CXkEyDQm5:OeyfryEr0xiM0F5REUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620347548, "uuid": "1f8ecb92-10c6-4775-acdb-e4390d4ad0e5", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620347548, "uuid": "056d6003-2042-440b-acdc-b5cd03b9501f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620347548, "uuid": "91c1ecc4-dc54-4d52-b706-c8e637fa1a5c", "value": "09706a2a5b49051e7faeb7f37c7a3716.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ef982c-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407164, "uuid": "270fccd5-32b1-43ae-8fdb-fa3898abd1e8", "comment": "Malware payload (Dridex)", "value": "898d94c0fe22f1d4cb725febd87a8bf4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407164, "uuid": "34a8f820-2b5e-4b50-83a1-5632c9e73c65", "comment": "Malware payload (Dridex)", "value": "44c165a2ba2c4eafd3cef7e9a34596e3df173b41caba541cbdc4c273f9731d5f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407164, "uuid": "ed0da4be-cdca-4faf-8ded-687913b0c4aa", "comment": "Malware payload (Dridex)", "value": "0c1877ad2d0a7b40015a2324ecab2c54ea8d0ed2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407164, "uuid": "b397ac38-2db3-45d7-95aa-103a1368efbb", "comment": "Malware payload (Dridex)", "value": "56dd0a84d9ee73533f541442b7a45598b0c0f327c89f7aa42dfbea6f78eb1ced609370dd24650c20958918890fb49825", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407164, "uuid": "57887989-2294-4102-9e88-3720e7c0f879", "value": "A8F3D081E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E051A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407164, "uuid": "393aa450-8fba-4f52-b16d-72a33e408eb2", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407164, "uuid": "2b6989db-739d-470c-9bde-db9c2ee3ee4e", "value": "3072:eBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHRX:muXLcclWEc2HeSjNjGdexX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407164, "uuid": "89ce087b-a794-4510-b01d-1fd723d5e46d", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407164, "uuid": "367ed84d-0a73-4cc2-941a-e2edfbc4c8ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407164, "uuid": "764e3da0-47c7-4b80-a24f-e301eb52e71b", "value": "898d94c0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9873f148-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620414074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414074, "uuid": "01b58488-860b-4916-a972-44ec72fe0e0d", "comment": "Malware payload", "value": "85882937fba25de514ae2a8bdfca00ec", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414074, "uuid": "bc2236ba-a9e7-47b2-9605-de1697486f14", "comment": "Malware payload", "value": "44e0c2f0ecf484f7274c04effcabd2fcacf59cfcd1837026615949384ac082c0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414074, "uuid": "191b0cc8-14a5-4c8a-9472-ccabb6b5a3da", "comment": "Malware payload", "value": "ebd9ec03fd450d6945300ea91ae613824800fa3b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414074, "uuid": "250a55a2-52a4-437a-9e2b-09e8e4d62552", "comment": "Malware payload", "value": "3678769ddcec222930c198e1629e5157616cfa7d7e96ebf509c01c77b9eb5b94de66c4b89ac27846a7ceb55fbdc95095", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414074, "uuid": "7c509c49-c777-4ff1-aa03-566d9938de48", "value": "C8F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414074, "uuid": "0e7f5a53-d348-4e9c-8801-098ff065ecf2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414074, "uuid": "9de47f0d-9587-4cb5-9897-67d743f69eb4", "value": "3072:6IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Tc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414074, "uuid": "45925eaf-16be-4c2a-91f2-1aee05f88ef8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414074, "uuid": "1723a2f8-4ddf-4e42-bea2-637f7b7d7112", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414074, "uuid": "867d95df-20d6-46e3-9122-e1208d7c40ae", "value": "85882937_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136b5eaa-af88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620428454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428454, "uuid": "b1ced1ba-a622-41d0-8934-166a10d2692c", "comment": "Malware payload", "value": "df1d392ab601615dce100123540a4c32", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428454, "uuid": "59eb950a-7647-4125-8ce4-569ff2345ea9", "comment": "Malware payload", "value": "44e1379debd75da9e419e277c59e516d899efee352ddc6c3407ad16a22b2853c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428454, "uuid": "c60c9637-d409-47c7-a354-9ba80388405a", "comment": "Malware payload", "value": "21093bd144fd92949347b5721d546712077a6913", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428454, "uuid": "f0b0ebb2-0f6c-4182-a028-edab17c15ad2", "comment": "Malware payload", "value": "c92b7ab6741eeee72f49c2ab1ef77cc82b757bc1df4bb6a293ef290e7c145002cfa982853e065ed6f6092c29729a1cf5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428454, "uuid": "220683f8-8f07-4154-8026-ae00586583ff", "value": "86F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428454, "uuid": "7ad07c5b-ca70-47c3-b8fe-a9ee23874f7c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428454, "uuid": "b99f2873-78ac-4dac-bcc3-45705af27ec5", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620428454, "uuid": "729e026c-3341-450f-90bc-1f97290de2d3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620428454, "uuid": "926ed4b0-d703-469c-b17a-5586b2e04c32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428454, "uuid": "4341482a-d148-46f4-9f84-479c3d9df646", "value": "df1d392a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00790a3-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404208, "uuid": "62e16627-f1c5-4f8b-ac71-bb26c2fc0f8c", "comment": "Malware payload (Dridex)", "value": "73654e1c58d93526e11d84fe9345b104", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404208, "uuid": "6c4421b9-8248-48ca-9457-e5a4e4792b09", "comment": "Malware payload (Dridex)", "value": "44ef579cfa01151d838f9da5bae54a4ecd10dbcaefe0b31a48e4ab3beccdc0ae", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404208, "uuid": "bc2addd9-f9e0-4ff4-80db-7db9819ce985", "comment": "Malware payload (Dridex)", "value": "f2433cbcdce8b4790029ecc7e6dacdbff5f7ab44", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404208, "uuid": "e5aab0db-6e2e-40a7-8a6b-6f9e0e23c1c1", "comment": "Malware payload (Dridex)", "value": "b7e16d513b91df3a006e5a7d87786afe1207a0e4f15d7b8a5a032cc823dc04aaab008995855040875df8010c701b1ac4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404208, "uuid": "50b1a563-e803-4617-bb95-a4ded8529b91", "value": "0BF3E081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404208, "uuid": "9602f3ed-3fb7-4f9a-b85b-ea13f7a354ac", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404208, "uuid": "707efbdb-2d03-4156-ba32-e3ef038f04e1", "value": "3072:OBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHAh:2uXLcclWEc2HeSjNjGdegh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404208, "uuid": "f0b45bf1-b23c-4a00-a141-25fda48e6a64", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404208, "uuid": "4441d853-51e0-43d3-9a20-4e3d2ee5b965", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404208, "uuid": "4494c37c-7e80-4cba-b1d5-5af19dfca5c3", "value": "73654e1c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a066aa41-aef9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620367272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367272, "uuid": "2ee6e435-0146-47e9-a4f5-411ad42eb7a0", "comment": "Malware payload (Dridex)", "value": "93d54b2b1d3b88e705fe0e27ddd375b4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367272, "uuid": "9280ce76-5bb9-4715-a14d-5b4d43ec0a59", "comment": "Malware payload (Dridex)", "value": "4543b3d999ffeee81091c13112ec8bc36da6e562f13318ae048e38df7dfdd26b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367272, "uuid": "336a139a-ecc0-4451-a8a8-e12935b01d95", "comment": "Malware payload (Dridex)", "value": "85a998128f7e0bf8291dd2640c0f6cbc67b17d9b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367272, "uuid": "71de889b-501c-4ee6-b6cd-c49bb447d725", "comment": "Malware payload (Dridex)", "value": "f22c1aa251c5eec7a0701aa38a7d13a8c43e16a36915e1f8b8b83fbe67bf930007cdb9d2c61dc0781403202da7ce8caa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367272, "uuid": "f20eacd7-8ea8-4ddb-b8b9-10c53f33a81c", "value": "80F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367272, "uuid": "f614107b-d50b-49c3-9407-e4c9ed270b80", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367272, "uuid": "748f731d-7871-4cb4-aa13-8a785b4d6f91", "value": "3072:1WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:142IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620367272, "uuid": "8934d5d3-195c-4bba-8a89-82eabb05667d", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620367272, "uuid": "624d1e3e-7500-4629-be34-bfb3943bf566", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367272, "uuid": "6383488c-8a3a-42a0-addb-0c42efc5b167", "value": "93d54b2b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc444b6-af77-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620421329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421329, "uuid": "573a25d8-0d31-4c26-88cc-aa47dece4c25", "comment": "Malware payload (Dridex)", "value": "f1b036d31488fe8cc2967064878df0e3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421329, "uuid": "85e34478-1858-49a0-b42b-18544769a393", "comment": "Malware payload (Dridex)", "value": "45bc9a438e2b60a848fe87f97e31a918539d8fd4565b8b3be42a3f6bb05362e7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421329, "uuid": "8d79acaa-a144-4ea5-8c71-3032db1f5eb7", "comment": "Malware payload (Dridex)", "value": "322db30557070b1e6da5830bb157c2f79f2c30b6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421329, "uuid": "68b77a80-5fda-4b35-a90a-6948be28862f", "comment": "Malware payload (Dridex)", "value": "c38e6bb58afcf04b6c3345f2a881c90ea4ababe97fed0ad6d128132880e03072e470898df794a795521412c616857f50", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421329, "uuid": "7a9acef1-915b-4571-982b-e87829f627f2", "value": "79F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421329, "uuid": "2528449b-e082-4dc1-bd92-1ce99f0da82f", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421329, "uuid": "5be670dd-459f-43bd-891c-e73c09c54be5", "value": "3072:wiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:beAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620421329, "uuid": "0fe2a8ed-38c4-4825-ac9e-27d7eba4878a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620421329, "uuid": "f5541249-70d9-40e1-b893-4ad72c01978e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421329, "uuid": "f3f80f03-0b50-4809-8195-dbeac3e59287", "value": "f1b036d3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7ed2c6-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407267, "uuid": "098a7c15-c588-4b8e-982b-9d4a75c9c771", "comment": "Malware payload (Dridex)", "value": "27ca0cc927a8660f7c3fe46ac444f487", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407267, "uuid": "2442942f-5130-4934-8045-ec5519485ec3", "comment": "Malware payload (Dridex)", "value": "45c705d47d242ae8648427b50b5509e93da68fa050f0c4bbbd359293421580c2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407267, "uuid": "3b6c4c43-4ddf-4bba-8fc6-00afd235c4ce", "comment": "Malware payload (Dridex)", "value": "b127b5a46c33f2dd73d5c761eef5a1a98b7aa576", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407267, "uuid": "0b6ccdbd-ec28-4e36-9e9d-cf9f657926e2", "comment": "Malware payload (Dridex)", "value": "66153d2266b123b187024ab5881807b44fa149dcd7750901c630e5508bd7890e543f14c6b3e29648a5b77ba766b87474", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407267, "uuid": "272d31c3-f54d-4d2e-859d-c2d7d13c641a", "value": "B1F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407267, "uuid": "5e7efd64-2b01-47af-8529-2525b98e6218", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407267, "uuid": "dc3ffcf9-3ee5-4492-8749-d833f0c71b94", "value": "3072:QBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHC/:kuXLcclWEc2HeSjNjGdei/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407267, "uuid": "1a4c1e70-d7fe-4fc8-8d89-46a0994389de", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407267, "uuid": "4bb0ec24-c0ee-40c0-8f7e-076183aabe21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407267, "uuid": "027c2415-9edd-49cf-a961-4c7ee7dfbbe6", "value": "27ca0cc9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cccc3ff9-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407290, "uuid": "fd2ec3a1-649e-44df-b9ca-882eb96289a5", "comment": "Malware payload (Dridex)", "value": "5efad646135ecac04352d56d99dfb024", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407290, "uuid": "d23b4f3e-213c-42d1-8efa-a8101e71fb77", "comment": "Malware payload (Dridex)", "value": "46239216281b9206f37c9b7fb8ae25ab27fdc06cbc110319b750d92789b75110", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407290, "uuid": "85a0f341-6467-4edd-9e1b-16d5e2a89f98", "comment": "Malware payload (Dridex)", "value": "79d9721735fedb92427865eaa4dfc663180f4457", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407290, "uuid": "246c779a-1dfc-4f90-9fb1-8566db0a21b8", "comment": "Malware payload (Dridex)", "value": "2ed5d6cd57a3d707d927e9d8fc9453fbad843e0af896ee03c9164c8e62d65fdbc389dae6298731691a5e0df5891068d8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407290, "uuid": "f443176c-7214-4f71-88f6-0befc75b1fbd", "value": "39F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407290, "uuid": "2bfe65ee-3906-42df-a947-5df190d27c90", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407290, "uuid": "b0816a7a-ecad-457d-a2a7-fb64a88417d6", "value": "3072:2BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:OuXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407290, "uuid": "cdd13c73-42b7-4c3b-b745-f797552ba247", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407290, "uuid": "13f31a51-909d-4356-a478-030e16d40660", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407290, "uuid": "f74ee52b-631f-490e-920b-c4ca1d31f0f7", "value": "5efad646_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9340dde-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620407740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407740, "uuid": "c114b2e0-54d3-4d69-bf60-d68f425b5642", "comment": "Malware payload (ArkeiStealer)", "value": "9e12cb9e980c8378a5671266b4941e7b", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407740, "uuid": "c7af80c5-031d-4afb-b8a5-8f28f029f4b8", "comment": "Malware payload (ArkeiStealer)", "value": "46338edf80cae4b55da5d78f2ecdc049a94800d7795bb870cf59ce9724d8685e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407740, "uuid": "98ef9730-b34a-402f-a216-76495e3ccf49", "comment": "Malware payload (ArkeiStealer)", "value": "b03d0374be7622012de015732148a08979db64d4", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407740, "uuid": "d66927f6-80d0-4b9e-9577-51293f525018", "comment": "Malware payload (ArkeiStealer)", "value": "84df1d091d0b587aca83de1c230ce5c5783fa21d178ecb62457a7ea64e8b9e8b2d140f126166c65a52d948a5c2e2dc68", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407740, "uuid": "c0437214-9eb9-4a91-bbf7-73aad9ff0508", "value": "B3E4E030BAD0C034E5F716F849FA93BDA6397DE17B2850CB62D426EE57246E4AC31247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407740, "uuid": "e7add87f-0002-4fb1-b08c-f0e8b7333c2a", "value": "063255465708c5d561d9303ddc23f4f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407740, "uuid": "418418e8-368f-4433-a146-208127f5c470", "value": "12288:DslGyZ/tT3wA45PTiZCyqbz0sSfAMWaA:r+/Gb2co3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407740, "uuid": "00b8e8f3-9de5-4015-b51b-e1135aa12584", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407740, "uuid": "f0a88570-330b-4246-9803-d7c5ce5ad136", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407740, "uuid": "5da6bb20-83f7-4afa-8d3b-51adf1e52c10", "value": "9e12cb9e980c8378a5671266b4941e7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1041512d-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403537, "uuid": "83666d3b-d1f7-4329-a2c8-e62d9a1e9029", "comment": "Malware payload (Dridex)", "value": "bb18b896a023763a27cf0177442faf9c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403537, "uuid": "a958b9c1-3fc4-40cd-9c17-1ffa1e030bf3", "comment": "Malware payload (Dridex)", "value": "4640a20fdc4e9c0e564059c7a5603ab63105fd3cf123d633e5f18830f936298e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403537, "uuid": "f5777cf4-08c4-4179-b20d-5a1754a4eaf7", "comment": "Malware payload (Dridex)", "value": "9e6477a6837623b224d3562d471a873e63be89c1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403537, "uuid": "a29d1aae-e9d7-48f1-b383-63f60162142f", "comment": "Malware payload (Dridex)", "value": "827c0c35b168ff0a73ee6bc086e59a9e7055dfc0b740772962db2efa89d05660f4b8dff5695afb47dc23eeefed623935", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403537, "uuid": "761a1579-1709-4a72-927c-c23689f314ab", "value": "19F3D080E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403537, "uuid": "0ef13ebd-4597-4f9e-b190-181a52bcc657", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403537, "uuid": "ff8be98f-e623-4d0e-909c-625b50b2d2f0", "value": "3072:IBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHNz:MuXLcclWEc2HeSjNjGdetz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403537, "uuid": "a6d6c03d-db12-49f1-9b35-6503e289c666", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403537, "uuid": "86786ca4-3215-44f3-805c-1bc781c41c7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403537, "uuid": "6b2df8ef-212e-4a6e-822a-3f3bc5b78c6f", "value": "bb18b896_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54afa88e-af77-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620421262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421262, "uuid": "2a681e62-b7bd-4871-bc42-34d7094d6325", "comment": "Malware payload (Dridex)", "value": "5d1b281de83e831b07a5d00039833429", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421262, "uuid": "176a746d-7ea2-4a12-bf94-7833279b3a10", "comment": "Malware payload (Dridex)", "value": "464dce3a9fabaebf75469927bb40964af2080cc48ea4dc8dfbd7e887b179918f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421262, "uuid": "fe7d0124-c611-4900-a221-68fa882f963e", "comment": "Malware payload (Dridex)", "value": "83504cde2ca3c291713c5cc30ad9ba43a6244c79", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421262, "uuid": "76ede737-6e6d-49b8-8d7f-dfb7f1b5eecf", "comment": "Malware payload (Dridex)", "value": "879d7684788e063d9443242c8ea216868dfd78a7853abce28686b567612a7ec027a746189bb3254f4133dc69a2b00116", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421262, "uuid": "fa6abe44-8579-42bf-b777-f08e675fa69a", "value": "DCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421262, "uuid": "36326460-04e4-4fe0-9c06-b787a6fb7402", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421262, "uuid": "847db485-97f0-4dc4-94a4-1c9a91937500", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620421262, "uuid": "13fbd352-ba44-4c2c-961d-17dddfd2c91f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620421262, "uuid": "945d4a2b-757a-4675-8ec2-e803e5549fd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421262, "uuid": "9c44ba8c-cf45-4a64-af31-eb1d33d0e11f", "value": "5d1b281d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be90968f-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403830, "uuid": "27be4c71-16c2-4aa9-9b84-fa7ebae1b035", "comment": "Malware payload (Dridex)", "value": "442dbeda0339e9ff901a10950b23f2b5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403830, "uuid": "bb2cf6c4-1aef-4d76-b70e-5664b92d54f4", "comment": "Malware payload (Dridex)", "value": "46a94564c85e60097da28f5717aad9d452f114bdd3b0d065e151017438c4b8c8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403830, "uuid": "13a1d3ad-dbbe-4bff-b1fe-9be9d2c7823c", "comment": "Malware payload (Dridex)", "value": "514edbcefb7f6358c4d20ed88a6cf271a5059ef3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403830, "uuid": "9c814519-3ba3-4070-9ffe-a0d504a9a950", "comment": "Malware payload (Dridex)", "value": "6aec568457ee5135bf73655d9907e5aa5ea49f1a2eadcd2d67eec3a8e3a062c99fd90597cb7a73f4bc09b82f1deaeeeb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403830, "uuid": "e6a507ba-60bb-49ae-9283-5966ecf5def9", "value": "9DF3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403830, "uuid": "924a2a2a-fcc7-4706-b5fc-97a1b4c6f983", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403830, "uuid": "7afb8335-7b16-4e54-856c-422353fa554c", "value": "3072:pBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eH/R:3uXLcclWEc2HeSjNjGdefR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403830, "uuid": "895687f9-2e18-488e-b3ba-c8d2898fb81f", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403830, "uuid": "3acd7440-15bb-47fa-9f98-32cdcd3fa64c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403830, "uuid": "78f84c61-a68b-402c-873b-8fc11d030983", "value": "442dbeda_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335dd722-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404026, "uuid": "81e2dd83-a7b5-4bda-85ba-49386defceb4", "comment": "Malware payload (Dridex)", "value": "f909ca93abe9966187af0d4e417feb59", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404026, "uuid": "8f77d193-0904-4258-b451-fd00698c8ffb", "comment": "Malware payload (Dridex)", "value": "46af4c9291f44cafa92ff18737edf570239da61c6afc41cd2ff4289d3df91595", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404026, "uuid": "5ed6cbf7-c4a7-47c2-b0e5-5f18fe18525e", "comment": "Malware payload (Dridex)", "value": "3c4e3edf6031ac75d5a143f09a2622f908a929ae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404026, "uuid": "3ab44d81-33c8-4523-8a3e-342873716f02", "comment": "Malware payload (Dridex)", "value": "b84315cbede6ec90929104b900e1ee8e9265877af9a2e880d73a39401793f802c223abef1c1055cddd6e60f4462b6bd1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404026, "uuid": "760083db-efdf-4118-a089-ec6dec526df5", "value": "5CF3C141C9C5C8F0CBE36C364695963B3628B941995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404026, "uuid": "387088a2-1ffb-4ed1-b656-d47b1e15cd81", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404026, "uuid": "8568318a-9ead-48ae-9aaf-212047b22546", "value": "3072:JuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+em:J0czbty9uiaJlHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404026, "uuid": "e6726670-326e-44f4-98ad-ca1c73d00c3e", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404026, "uuid": "5b9c23f9-ac4b-4807-af31-eb7b16664db9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404026, "uuid": "7f16ef55-6214-4ac7-83f4-3b5b2fbb3614", "value": "f909ca93_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa66031-aef1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620363692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363692, "uuid": "d77b08ff-8b54-41b2-968d-34bb7a06e72b", "comment": "Malware payload (Dridex)", "value": "1cf4108c34c54c6aa5a826a88ed71f25", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363692, "uuid": "31354007-5d0b-4dcf-8e19-fca7c0b24c8c", "comment": "Malware payload (Dridex)", "value": "475f02a64f9cddbaeff087cb0e8ef796166de9755ffc8139139caf77da2c267e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363692, "uuid": "eef4926b-e6c1-4ba3-92aa-a3a1dc419488", "comment": "Malware payload (Dridex)", "value": "707823f0a3a5cb10fa079780ce99b85d0b876178", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363692, "uuid": "2d775833-fbbe-4c6a-b8e8-5007e3161aa6", "comment": "Malware payload (Dridex)", "value": "9ed560649f7a3d657e7b6c4eb97e8f1bf3fcc66db94b154069b5bc53627480942e22795a9773bf47f8901185e0622e7e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363692, "uuid": "8fcd8d2b-deb1-4530-88c7-5ceb5d09d657", "value": "0CF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363692, "uuid": "2849e0a1-d3e6-4a0b-b939-fbdd78c0bbf3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363692, "uuid": "24917eea-0549-48f9-91c8-f0cd3bca16c0", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620363692, "uuid": "d86bb291-f2ff-475a-902f-15ef347f3980", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620363692, "uuid": "4dc5df99-c33c-4575-b03b-fd17495bcaf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363692, "uuid": "d74caf9b-fe0e-4f3b-8988-0c641d17ef5e", "value": "1cf4108c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f9bc4d-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620392588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392588, "uuid": "442280ea-f267-4542-af53-387ff2e1c186", "comment": "Malware payload (Dridex)", "value": "60439c2b1b24beab98dea5a07c2e78ba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392588, "uuid": "b4c055a1-d286-496e-871c-c87c25adc772", "comment": "Malware payload (Dridex)", "value": "47a5eb50ffa35232e8cfaf619d93a7c4735792d69a1769c20f9865fe57e7dc65", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392588, "uuid": "7b631e8b-0de7-4b38-9f6c-cc87f7dd7ba1", "comment": "Malware payload (Dridex)", "value": "d3ef778863142e9186819c14a3e3cef6ca05af2f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392588, "uuid": "eb42eefa-4dda-42c4-90da-3c28dea3b66a", "comment": "Malware payload (Dridex)", "value": "ed1d7bdbc968b9b570a7a4959b04ffb90c0dadd1619fb2aa9be0bad688240ab9d64b7b9657076badb514901241c4854d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392588, "uuid": "45110a1c-eafa-4ac0-8259-9ce4918d59a9", "value": "E7F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392588, "uuid": "0f703bdd-9a12-4555-ad1c-3b80e076def8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392588, "uuid": "2eb87e65-8448-4b39-9ffa-6a636d2b408a", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392588, "uuid": "ea3253a9-33ea-43b9-bb4f-3f111c0b39f0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392588, "uuid": "2eada04c-8bd1-4b9a-9cb1-2c97eecbc3e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392588, "uuid": "29313ddc-e311-48e4-a216-624f03684424", "value": "60439c2b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fc6332-af38-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620394159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394159, "uuid": "4d54f092-66f6-4b27-a86e-6f37f70f299f", "comment": "Malware payload (AgentTesla)", "value": "ea5b1185737a06c9d7889104eb642217", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394159, "uuid": "4214a3f4-d698-4f8d-b92d-f4225a6524b4", "comment": "Malware payload (AgentTesla)", "value": "47aec25d8d3acefc90d01bb913af2a6d9060d893dedf3cfa62fe61e207f1a8a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394159, "uuid": "3f3d62f8-059c-49b3-b808-6a154b693c93", "comment": "Malware payload (AgentTesla)", "value": "bfc0c039d0c28404ce8b908e1ab2cec9d00e110e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394159, "uuid": "957702f4-cb1a-42fc-a46f-6111466e5485", "comment": "Malware payload (AgentTesla)", "value": "431102cb717b9c13d52696155ed7d308391319f5c69b5195c5aa5fc75e2072702dca25e7e05646984e79415673329fee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394159, "uuid": "49215c64-9a18-4f15-9271-a2f05c5191bf", "value": "15E4139E1BD4D91ACADDDA74ACE09046437ADA07B0439B9897E0C1F95F933F005132AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394159, "uuid": "cdad743d-e955-473b-ab75-d6210890ba17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394159, "uuid": "7bfbdd3b-b169-4d69-b295-e6af0a156640", "value": "12288:UBS9CdsuZa5j7l3dN/0UMoqxnb2D9nsSlf/d72LQuPvYKnMpoPN:bCdBZa5VvMLoEnb2DCSlN72ztwEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620394159, "uuid": "a010a021-aedc-457b-9ea2-9c8f0c426f61", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620394159, "uuid": "8a060758-7bb8-41b6-ba24-e48dfa1cc3e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394159, "uuid": "921fce2b-306b-46fc-b199-d99398b65d08", "value": "TwLWwzIEHiJyihI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0969c271-af02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620370884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370884, "uuid": "35a7ba56-eb86-4a47-965a-4a8dffaa64a9", "comment": "Malware payload (Dridex)", "value": "eed1a152e1fd5b8b20942cfeddcdf1ba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370884, "uuid": "0cf9fe57-af4d-4c7c-a438-c15a7f27949a", "comment": "Malware payload (Dridex)", "value": "47c1034f71dff2ffead11e8a2028a33a50fb2b6f17ffebb446a8d9a9475e5551", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370884, "uuid": "378af52d-d5aa-41ea-a1bd-71b326499015", "comment": "Malware payload (Dridex)", "value": "3b431bde32da9dc854c742c3e78777a00f183328", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370884, "uuid": "db1d8d31-ef26-4fd2-b692-862a1125961c", "comment": "Malware payload (Dridex)", "value": "2dd3c1df1079e42d552cef4c55b3865d7e309f69e2d34df87105d36dc30809c5800d8c744727e1534d68f07d9869a4d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370884, "uuid": "f97433c6-e4d0-4aa3-a771-cd187d07a977", "value": "3CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370884, "uuid": "470fffac-566d-4e95-b6f4-712eb0a17115", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370884, "uuid": "9c159b48-b16a-4d08-8f63-a3d3b6b3b72e", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620370884, "uuid": "f2806c36-80d9-45f0-a456-334db4127c6f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620370884, "uuid": "c3353b2e-4ec7-4601-bdc3-5c03a1108049", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370884, "uuid": "e419737b-db56-4ff5-b8e9-a2ae7d2b89ae", "value": "eed1a152_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7315e99-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403871, "uuid": "a2514253-8582-42e0-a3f6-5d4452b146ba", "comment": "Malware payload (Dridex)", "value": "48661fd04dc964b3c9ca1433bc4111e8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403871, "uuid": "a97142a1-0e42-4071-802e-fe95a9850700", "comment": "Malware payload (Dridex)", "value": "47d8a376596d32280ce9f5c6113be0cdba6fb6bde638dc12b57ea535bc2607f8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403871, "uuid": "7c125112-0683-45c9-8103-bb7e2089dccd", "comment": "Malware payload (Dridex)", "value": "7ce371342b9a1711ccdece97cb9c896bbeb47bb2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403871, "uuid": "f2a12e99-d0b6-4383-9411-661ea917b7c4", "comment": "Malware payload (Dridex)", "value": "f001340c1f29269148c7f89b5da095936d924cacf27dd58ffaeefbfb27e5848db06eaa0cb920cf228cc569bc05a56c1b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403871, "uuid": "cf0dd1a6-aba1-4483-ba84-e23b21f3ffc1", "value": "24F3C141C9C5CCF0CBE36C3A4695963B3628B941995A8E42EC24CE3F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403871, "uuid": "82a8a81e-1185-4bb4-bf14-0337c5218fb8", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403871, "uuid": "446d8000-9c60-4a39-86c0-c31f47cafccf", "value": "3072:YuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+3n:Y0czbty9uiaJlWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403871, "uuid": "91d35a94-2e0a-4c3d-94b6-d7ca784ed2a8", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403871, "uuid": "005ee457-5b22-49c9-a79f-3868b67986b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403871, "uuid": "92205a84-4ebb-4d3b-b3cd-66f42a3ce6b2", "value": "48661fd0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d2123b-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620392487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392487, "uuid": "564e563b-4c8b-43cc-a90e-30273b669b67", "comment": "Malware payload (Dridex)", "value": "f249ff7026b6844e5d79d49d987d9b81", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392487, "uuid": "0cd21a11-b776-4d79-bbd8-5bd003d2b792", "comment": "Malware payload (Dridex)", "value": "47e13ab72f864ddfc4f85112c95e76f4c3f3490409dc0e7da0840ec60b0023d9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392487, "uuid": "a66b9ce8-9d88-43d5-b2ea-1a565ff24f30", "comment": "Malware payload (Dridex)", "value": "06f292bf9858cf2c4e2e876d75d53571c4220a99", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392487, "uuid": "797e4c90-8b60-4abb-b77b-1e743d5ba6f2", "comment": "Malware payload (Dridex)", "value": "572809c5bf231b486105dd08a4553776484ac8d4a7ed14eb39cc27f10488b5cec8abf4700f1145cefb499e2ad1466440", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392487, "uuid": "22d2871f-28dd-41ef-97b4-445f86a0fd65", "value": "D7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392487, "uuid": "7ec8795c-6343-499b-add1-9b772e4bcdcb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392487, "uuid": "dae062cf-96df-4d95-b7bd-5a765ebe105c", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392487, "uuid": "b88dd13e-32c9-4301-bd5f-21d35fcc925b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392487, "uuid": "6188c154-e405-4d60-9e70-1aefc81ac761", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392487, "uuid": "7a529c74-496a-4322-9923-fc22d8037514", "value": "f249ff70_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d540fde-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407452, "uuid": "f22f6c3c-cb53-41eb-85fe-7d1ba792188f", "comment": "Malware payload (Dridex)", "value": "9a737f01c442fa24a52df1c7d88f41c2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407452, "uuid": "b0bab5aa-c974-4e35-a56a-36d333ea672b", "comment": "Malware payload (Dridex)", "value": "47f00028c5b27b2168b1284e9d90cb30de1f8393777ba548dcde4f70bc4823e0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407452, "uuid": "2fc7209a-04d1-4fd1-9d68-e33ab3d38cfb", "comment": "Malware payload (Dridex)", "value": "3dd17df4ac0e8fb4f2434addbc12ff5845efc069", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407452, "uuid": "6c426e9b-f4eb-4b58-8f24-62629842d2d8", "comment": "Malware payload (Dridex)", "value": "886c5d82c4e63fc0c1b88bb6c6a0e4e379c1fd489c0440cfdb94841480ee8612c9708cff9959925a2e818ecfd71c0c93", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407452, "uuid": "f9f48c98-1979-4ce5-a0b5-47748cf75782", "value": "C8F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407452, "uuid": "72c053a1-6a4f-4445-a953-c7f40934bb79", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407452, "uuid": "ba9e4b23-fff7-4d9b-b000-3458a8352a6d", "value": "3072:gBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHWh:UuXLcclWEc2HeSjNjGde2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407452, "uuid": "66261db1-aa91-4b73-a486-a142b4aa9656", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407452, "uuid": "16da58c5-deb4-45ee-9c52-b1ddc4f90934", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407452, "uuid": "055975a2-a4c3-4575-8a50-89f20ad21531", "value": "9a737f01_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67c01d0-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403816, "uuid": "34a2af59-9c4a-41db-940f-9342132a33dd", "comment": "Malware payload (Dridex)", "value": "d9dc8496e57bc1f7e92300510f8592ca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403816, "uuid": "ecbaa887-f924-4aa2-8df3-75be460ee460", "comment": "Malware payload (Dridex)", "value": "47f7e33f03a4f9ff26487b0b58357e1d123851ac3996b74dfe50b69edec06c6e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403816, "uuid": "e24f9659-00fb-40b4-8979-4ffc90104402", "comment": "Malware payload (Dridex)", "value": "66f9481e3a494c4ef9f91ede37f23bcae89d8ac0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403816, "uuid": "0acec545-3d5f-40d9-91c9-9ac79d2a68f0", "comment": "Malware payload (Dridex)", "value": "f8243e4d4317ce8983a9b424beba8c35731629808a1e47a5e6f514e56d0fff541c43275c5693a40d5e6ec1bfbf4948ca", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403816, "uuid": "b50560d1-47ea-4f6d-957b-f68917db67c6", "value": "EAF3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403816, "uuid": "8380f6f3-1c15-43a0-8d5f-005b9c3fe2b8", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403816, "uuid": "88018ea0-4232-46dd-9688-10456b8cb6c2", "value": "3072:6BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eH/R:KuXLcclWEc2HeSjNjGdefR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403816, "uuid": "9a3a8022-66b3-453b-9a7b-bfb7a704ec5e", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403816, "uuid": "aafda905-493e-4b3a-81fd-09e118666221", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403816, "uuid": "b36e44bc-7217-42e9-a430-d288e26d4a6e", "value": "d9dc8496_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68299581-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407121, "uuid": "1e16142c-80d2-4f9b-b59c-b1034978c1e0", "comment": "Malware payload (Dridex)", "value": "e6ab7e2d52bc12ad0ee93e3c6c726751", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407121, "uuid": "3ed15c26-9e43-4477-8be0-4607633de305", "comment": "Malware payload (Dridex)", "value": "483deb64ebb57d2360817d1322018c7f4eefb202e41493c238ce1941e75fb875", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407121, "uuid": "b25d7f6a-bd47-4b3b-9217-3db3680ecc8a", "comment": "Malware payload (Dridex)", "value": "401dd3ba7d5a7a6f0065460d9feba7ea50b894ac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407121, "uuid": "ad56c369-3547-4f62-9b35-18bab5d3e203", "comment": "Malware payload (Dridex)", "value": "c3b10551152f49007a369f08897c2134e07e0beeee637eb9cf0d8442ee60fa4586db60ee7848bc477eafe41f3b1874d0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407121, "uuid": "726a1c1b-b6de-44a7-8583-4ec091db167e", "value": "31F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407121, "uuid": "b1fd9e8b-5b64-4f9d-9c6a-70aac3c8c80c", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407121, "uuid": "c2aeaeb9-6a89-4c87-a897-418b8a413e0e", "value": "3072:nBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:BuXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407121, "uuid": "fe933e8a-4f12-41d5-8bb5-4cffcac0ac60", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407121, "uuid": "645d37d9-5642-4873-bdd4-032721c8d840", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407121, "uuid": "fdfd4dca-e7d1-403d-91dd-2e7ace3b4205", "value": "e6ab7e2d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041acdb0-aef3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620364433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364433, "uuid": "c3dd387c-3bb4-470c-ae0a-930ae1c68114", "comment": "Malware payload", "value": "eef08365ee3d38dcf90a93c1a0817e64", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364433, "uuid": "e64aa38b-0409-440f-a0e3-ac9a88d58689", "comment": "Malware payload", "value": "484051fcf1d7f8de7084c7419cf49f65b85ab16642093d5c4249002e9e31a00c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364433, "uuid": "8d91c80b-e974-467b-86b1-91f565eb0db1", "comment": "Malware payload", "value": "32a92c1beef6af07069924387a8bd069572eb83f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364433, "uuid": "676d2ad2-d254-43d1-8c2c-378c1f1d3137", "comment": "Malware payload", "value": "8ee78ac99c6dcf3cfc8a87d85ff0f0d76c02e9a8f751100ace25d417dd9aa9367c6a3828110213b08860bc15cf57acd2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364433, "uuid": "cc438597-f7a8-476f-a2d4-ed07383ecd07", "value": "E45312E3DA352B64CCF9577856DBD088CF0CCFD29F5428190FC91F99DB28C995289650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364433, "uuid": "630f9a8a-1c9a-4079-b129-39ca6b0da911", "value": "1536:h5AC/ccp6XY6lvRid881+WD9ZPWHr+Nbtd6:h5AC/Hp6XYnDS+Btd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364433, "uuid": "b6cc49cd-86d3-43cb-bb75-606e1e008ecb", "value": 65360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364433, "uuid": "4703f6a1-7829-4304-be8a-50e76af48307", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364433, "uuid": "cdac30f9-8226-49ff-bbad-b17db81d583c", "value": "bc_memories_from_the_mcp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16699e09-af88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620428459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428459, "uuid": "43039511-ae11-486e-83f7-ad5dea28c72c", "comment": "Malware payload", "value": "0929567d71844bc6829ffec4193d5fd0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428459, "uuid": "0522fd0a-397d-4a7b-b348-670c59e07619", "comment": "Malware payload", "value": "4849925fafb6affb4bb672938ce49e966923250deff97235e62d92e3ad6e6d39", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428459, "uuid": "523068a4-b31d-4676-863f-9d720db7c672", "comment": "Malware payload", "value": "d349e90fa756dd6021571cac4ff859198a574b67", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428459, "uuid": "c3cbd5ad-69d6-48b7-9d9b-a24ed94b3de9", "comment": "Malware payload", "value": "9a0b0b018d0b18b069da1a0a795ec23a9b030dcfc6bc4d9065efaa083be2a8b5286195cb29b32e4456ec6a6ef96fa321", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428459, "uuid": "f7d6ff26-7424-4544-89b8-eff0b6d2a0fc", "value": "67F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428459, "uuid": "af1c79d1-50fe-4738-9b8a-c4ba1faff867", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428459, "uuid": "47379a16-2b38-489d-bfbe-bbcb48a7451e", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620428459, "uuid": "1fd037ad-ade6-4b88-9861-2fe067895986", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620428459, "uuid": "9d54dcb9-6609-4720-ab88-7e33a7123a5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428459, "uuid": "6cf8e7bc-fd10-4e5b-b99d-076d05c95ed7", "value": "0929567d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d6189c-aeef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620362993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362993, "uuid": "0a6e1e4a-7af8-4b35-9776-f765bc18c433", "comment": "Malware payload", "value": "18b6865da4d3970fa3c102731ca82d96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362993, "uuid": "1b9ecb8c-b75c-4390-9d87-a108d4120124", "comment": "Malware payload", "value": "485a5454645f5d90d1b3097336b08dcaa9d4b49db9738a2f953e81081002600d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362993, "uuid": "8b75f418-d3dc-4226-b388-8ac3269879da", "comment": "Malware payload", "value": "39f2dc79978a6bf937aa588998b14ab05b70ff83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362993, "uuid": "fa0a7b73-ecf9-4d5c-a2b5-68cc1e83392b", "comment": "Malware payload", "value": "3b62195a2c177990b6e9641f258b945d001b5a02fe0261bd1b581b5d4c4e584864367a7490f321fd222e743a0ff5a160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362993, "uuid": "d44e054d-9d34-4f3d-9928-56a0c4d00564", "value": "F23533AD882B5F48F458B2F7C40FAA366159D309C143C7A1A6F175A9F8B57C06C91CCE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362993, "uuid": "216615c7-e1e1-4f3e-badd-869010dea88c", "value": "80f37801b18696aa5d4a78f9854a6ace", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362993, "uuid": "252e0ac0-f375-4b70-a6de-19d70d5fa14e", "value": "24576:NxloCukO/lRO0L5BBfS6MNv/jzQjThDzILxk5D:NxeCAbHBfS6mnje4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620362993, "uuid": "a50aa4c7-dd49-4acf-884d-ec4a213e216f", "value": 1082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620362993, "uuid": "2e36e4af-62f3-496f-996a-4e24b726bf95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362993, "uuid": "9b31d4be-ca1e-4a1f-a69b-763010078aeb", "value": "2014-06-12_djylh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f727e63d-af2c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620389322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389322, "uuid": "423a8442-cb3d-4d41-a27e-544f76f094ad", "comment": "Malware payload (AgentTesla)", "value": "67bfe027b60278a7c538e3cc5a7b5ab2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389322, "uuid": "f1e78ffd-18ca-42a3-bf8e-c8b836c214cb", "comment": "Malware payload (AgentTesla)", "value": "48f60cae51e51d9eb76e65c8afacb3248ab8d6227d15028ebc9ab00a58b2d4fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389322, "uuid": "7f48ff7f-029a-4f03-abe6-8aec47739687", "comment": "Malware payload (AgentTesla)", "value": "a6243774b4697e44c8c2463b19d99c3ac4cf3774", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389322, "uuid": "b9b56850-9fb8-4a0c-9738-aba132fcd4a3", "comment": "Malware payload (AgentTesla)", "value": "9085de96dde6f18358dc351732f2cce6da3af0b78fc540af40c8ba4b66fe1abd33a77d87d6261dc83ff5e2be5b98e0f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389322, "uuid": "8788bbeb-f07c-488d-8dd8-314077ed1a88", "value": "95D4235A854D39E1E40B0DB7528ACF1F23542C7928583C3ABAC1A7EB6863C9FF08505B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389322, "uuid": "309e4c26-6fb0-42f5-b5b5-daf03a2ffc03", "value": "12288:Xn1Qm3/A2GQgK2ve/9TgbAbjcPC+Kc29bSt7jGGJ5qRVRK6Nwi:X1Q8/zwveisvcPAZ92dyGJ5qRKEwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620389322, "uuid": "55a8aa41-50d7-4581-ab88-de073793da40", "value": 646313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620389322, "uuid": "7fabc1d1-78a7-45d4-ac1f-096b9ab97b72", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389322, "uuid": "cb74395b-7189-404d-987a-69bd408f5774", "value": "RFQ 11054.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8469889e-af0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620374527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374527, "uuid": "41b815f2-814f-49fd-a51a-dd22e6c199b4", "comment": "Malware payload (Dridex)", "value": "2affe12adbc6d101018c98d5ad2ecaad", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374527, "uuid": "27dc0428-02fd-42bc-882b-a0ac4701900a", "comment": "Malware payload (Dridex)", "value": "4927acc11ad02a40697eb6b95e655f3310a121980d5faa96cb97c237a5a6dd1a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374527, "uuid": "09467dda-bf5c-47be-9b86-3836a3f64f73", "comment": "Malware payload (Dridex)", "value": "c5819872dbb9129a3fb8dbb7725651f9343349c0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374527, "uuid": "9a7c88b7-b242-492a-b72d-c9900e6fd23a", "comment": "Malware payload (Dridex)", "value": "f32c86a4845023a0b4bcd66242fd409599bda96e5db077b815819bb71a60a4637c2b2b184a6c1786260a036736b47111", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374527, "uuid": "5e240a16-8ad3-496e-8323-50f0165c335b", "value": "30F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374527, "uuid": "1e9c1440-8bed-4c9c-bcc0-b57d2679c537", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374527, "uuid": "c34f1741-7619-4a30-9230-e70b16d6d02b", "value": "3072:olpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:olo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374527, "uuid": "a7d81a88-b24b-432d-8d9a-b923c4471883", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374527, "uuid": "2c037284-d8f5-4b26-81a6-7e31dada4869", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374527, "uuid": "51da609a-1ad8-4750-9849-536fa5fcec6d", "value": "2affe12a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53594973-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620392483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392483, "uuid": "b9f61e73-1447-4171-9d1a-a7f6215a1b3b", "comment": "Malware payload (Dridex)", "value": "3b2d54c08548ed4c9392f77ca53ad2c9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392483, "uuid": "56c587a0-3cdc-4481-8d2d-d60845ed0b85", "comment": "Malware payload (Dridex)", "value": "4943cd990267a2d10e43047d1accbc7e49f169d88fc24b2df325b9b84af12ee1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392483, "uuid": "70f7097a-823d-4f5a-8ed0-3d93ec170e9b", "comment": "Malware payload (Dridex)", "value": "0318c49d71f3500b3045567479c5711813758387", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392483, "uuid": "7e0479d5-e49a-4c9d-9f32-f3fa5affbca9", "comment": "Malware payload (Dridex)", "value": "6adf5a11c8fbb117cd0d14adc5df452fad26e48130ae0b97979a3ad4bf365f052a12f8f8141610d95f235a269ea82030", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392483, "uuid": "06bbeaa5-f0b5-44c5-9dff-f16ad14cf318", "value": "6BF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392483, "uuid": "40dc9a45-a284-4c99-9a56-f58891afe9a8", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392483, "uuid": "d98b7a61-554b-4453-a339-820bd6bea928", "value": "3072:wiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:beAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392483, "uuid": "b664d682-a501-40fc-90ed-59baac5fe000", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392483, "uuid": "8956f8bf-5ba2-41e7-b61f-9ba707db2e6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392483, "uuid": "f496e288-cfd5-4527-acbf-cf9c101f7ce5", "value": "3b2d54c0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e564f4-af1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620381718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381718, "uuid": "0822bf4f-8e06-48ec-8820-3bd83be7d148", "comment": "Malware payload (Dridex)", "value": "193b054314b4fea8a010a201713abacc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381718, "uuid": "cfe8d6f9-37a0-4ac5-9d23-3b505a8b135d", "comment": "Malware payload (Dridex)", "value": "495e23e83a121250399acc292b047a34f92af0d522eea28bd63a508ee39e7247", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381718, "uuid": "db6c35d7-79b2-4d82-9990-a71f15ff7fee", "comment": "Malware payload (Dridex)", "value": "a25d6c987874b915eeb08386f72b780fc88f02fa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381718, "uuid": "5e55ebe5-ffeb-40fb-8a1e-2c10f25f01df", "comment": "Malware payload (Dridex)", "value": "870e30b9a1e41f76271004a877c2fbb1c2e90d60101c0acbe559bd17699da93a065eb4bfc00ca421f960bca54ca435cd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381718, "uuid": "697d195e-a5d4-42fe-864b-b30b32810495", "value": "78F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381718, "uuid": "4c528837-77f4-4b5f-a0e1-6ff69dc374d7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381718, "uuid": "155452e9-a651-40c9-9ed7-7957803a74a7", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381718, "uuid": "f255c819-cd1f-4507-b3b7-604eb5cfd715", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381718, "uuid": "bb9dc436-e645-4dc2-ac5c-49be7a31a2e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381718, "uuid": "ce32ee5e-8c84-4b95-8af9-949f2bb62201", "value": "193b0543_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8fb03ac-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392224, "uuid": "37753781-ed1f-4b0a-9e06-e45380ca6715", "comment": "Malware payload", "value": "792482788945ca37eea005cfc1c5846c", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392224, "uuid": "3f67d3c8-164a-4e1d-a85f-ec8f53afa696", "comment": "Malware payload", "value": "4975b6a0cfb6384c147af65a4940d9511d573fb346acdbe79b8ed74b5e0368aa", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392224, "uuid": "e2ec9c1e-ce7a-4607-85cc-c5265af31c94", "comment": "Malware payload", "value": "fe23b3f755a2c8ed911e0c4696e04caf08929222", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392224, "uuid": "8cae6163-6c97-4140-8e2e-17caac5d01c2", "comment": "Malware payload", "value": "b4f6b90964bfb817ad3fbfd08e3ccc8ed699f8ab3058bf6c1208fdfb7b58efe21734775affd44b8826eb5abd4602658c", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392224, "uuid": "9d17bfa8-86de-4cd8-81c4-f9ef23de2f9b", "value": "E49423952526188A87EF4EDA7CEF3B98BE38889E66438BE30151FC37721554F8430797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392224, "uuid": "1fad2963-9675-43af-b5fe-347e514ec77b", "value": "6144:LfjxpurRQnlgmaQXKVFc7MZzamXvkvUB0V08306kOFD21N2Vt9U8Gpjg+xhYvR:Tj/uElgSyZW8Bx20Az9g1gp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392224, "uuid": "c5386ed6-e9e7-4d2e-bd52-bf11defb6a66", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392224, "uuid": "76f27b06-1f69-4276-8466-215ddb46811e", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392224, "uuid": "a3296baa-ac51-477f-a1d2-88f3ae44761b", "value": "4975b6a0cfb6384c147af65a4940d9511d573fb346acdbe79b8ed74b5e0368aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d796b56-af88-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620428497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428497, "uuid": "4af72dcc-a00c-4416-ba3c-de395e9cc32c", "comment": "Malware payload (Dridex)", "value": "5af626c2b0c94b128f97cb48be895f3f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428497, "uuid": "7286dda7-6d75-4b8a-82fd-deeeea089d1c", "comment": "Malware payload (Dridex)", "value": "498db30002b7c799e0c3af67f86ff99e195f69bf99bcdc42b757656ee454a769", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428497, "uuid": "c0ba2d4c-d8a3-4714-978c-cdc00ac11ee1", "comment": "Malware payload (Dridex)", "value": "ad56664a76b89fd6af8e7c98f1f9188700b646c3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428497, "uuid": "ded70319-0d6f-4818-934b-1e18b6531716", "comment": "Malware payload (Dridex)", "value": "38619a19341e80a889204d24f1febbf2a98722d3bc4458581068dc50216e487f9066a995d76180bf5c10c4ef7475ed01", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428497, "uuid": "dd881fa0-d7aa-4e34-8167-0ee6d418b839", "value": "5FF3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428497, "uuid": "e02731ba-6a15-4065-9ff4-b94b44ecd352", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428497, "uuid": "86448f45-e1c7-47e4-bb60-0c55b8e7fa98", "value": "3072:QuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:Q0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620428497, "uuid": "b68bb4af-7f48-49f9-a338-519ed029c408", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620428497, "uuid": "a8beea75-bf63-4fa6-8670-c662a1c5ce4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428497, "uuid": "a06f2913-56ed-4dc6-88f6-19f46a09dfab", "value": "5af626c2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3e07a5-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403828, "uuid": "5b903548-b870-48f0-9ca1-a69b87749bb5", "comment": "Malware payload (Dridex)", "value": "25ced316613a33c5bf664335324fa747", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403828, "uuid": "8c8a693a-bcb1-4a82-8a55-b1337be22c4f", "comment": "Malware payload (Dridex)", "value": "498fd3dbb83910b295feccb2c15179799ea38074c37a6afd00f37f55685f4216", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403828, "uuid": "0656faee-17bd-4906-844c-343b4f09d1af", "comment": "Malware payload (Dridex)", "value": "d65c94b8dd3cf946a600d5273eebae11a2cd0539", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403828, "uuid": "a6c786dc-ebe9-43d8-93d6-f89fc2faac92", "comment": "Malware payload (Dridex)", "value": "31bbd46e16afd9465e61b70ca23a07dbabf925313010bd6f8c2ca6d3abb1a251fd6ea6d49fb6cb5a0da75cd3a9c9143b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403828, "uuid": "31c516c9-e1a5-4191-97b0-cdab874919c8", "value": "1AF3C141C9C5CCF0CBE36C3A4695963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403828, "uuid": "46527568-1130-4400-8f0f-f7cf40853364", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403828, "uuid": "b572fbfa-1cb2-4ac5-9036-e2b8f19febab", "value": "3072:TuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+3n:T0czbty9uiaJlWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403828, "uuid": "4c219bd9-d485-43e5-9d05-6cddf00f9bbb", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403828, "uuid": "8f775cc9-b797-479b-a037-13e0bb66750b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403828, "uuid": "9849b377-89cf-4dfe-bba8-9523d9802525", "value": "25ced316_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad39899-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407152, "uuid": "6f25a516-538f-4db3-b65b-01586823bc38", "comment": "Malware payload (Dridex)", "value": "85d2dfea94b7b5449c0b3d27f7d8b72c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407152, "uuid": "e3a5f1d7-367a-4eef-b814-b6022d507178", "comment": "Malware payload (Dridex)", "value": "4994b7a5e90c9f4be17a8cc90d75b6b1dfa73ec486ebefea6f5c704fb837d052", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407152, "uuid": "37440d79-e570-461b-956f-de47a30f0ce6", "comment": "Malware payload (Dridex)", "value": "5e4dfe0ec89204791eceac1b9ad524e063fc58df", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407152, "uuid": "4c1763ee-1555-474a-9497-84dda94abdbd", "comment": "Malware payload (Dridex)", "value": "aa623ee60e3559421f9d38962f5566d9fed353ffc584293b056a82857963c9e718389f4f62c04f89155768dd0cc28d19", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407152, "uuid": "3fcf7860-9060-41b9-90f3-15ed0edfa12a", "value": "AFF3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407152, "uuid": "f8243d70-d15a-4cfe-9040-d1d782c2dc9d", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407152, "uuid": "77ac7d01-c3a9-4f63-8efd-0633a0248810", "value": "3072:OBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:2uXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407152, "uuid": "9355cac1-ccdc-4977-8796-1100f0dbd8af", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407152, "uuid": "e07fbdc3-18ec-4148-a429-eef6b9481152", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407152, "uuid": "5be37a38-d68c-44a2-b6fb-737d5e4adb58", "value": "85d2dfea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99de71e3-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407204, "uuid": "c2e6bcaa-c0e6-4aa6-9411-c4705ef5edd6", "comment": "Malware payload (Dridex)", "value": "4b7707e2b390646c5e72a6bb850e9d51", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407204, "uuid": "7ae4b23f-7a1d-4f67-bfae-754aa5c79d9a", "comment": "Malware payload (Dridex)", "value": "49cd4331f2ccc0dffdc727d948d6770160bcea59ee7bc232fcd8636a4e1bf17e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407204, "uuid": "290975a5-0d7c-4bdb-b548-4a8cfe928028", "comment": "Malware payload (Dridex)", "value": "c96dd360d024d130ac5849a066a8567585780fd6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407204, "uuid": "fb254c80-09b2-4108-ab9d-5b5909069ec2", "comment": "Malware payload (Dridex)", "value": "4599d8ad023a68d10f24269d7588d3b9ee04d9fb791eff7fd747c10e04bfca4c134405d34bb0c86152d529a5d728ebb4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407204, "uuid": "9eb8cbb7-452f-469c-8e2e-dcb086d20e1f", "value": "65F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407204, "uuid": "7d3f67cf-2bb8-4eb4-b0b6-77a7275254b2", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407204, "uuid": "ceae9b93-b569-4346-baa6-3a5c22758170", "value": "3072:NBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjf:juXLcclWEc2HeSjNjGdeDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407204, "uuid": "2cf11f76-fda1-4633-9946-045707e33fed", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407204, "uuid": "b9fb5107-9cf3-47b1-8110-55ec283b7e92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407204, "uuid": "7a4fb1d3-17f6-4cf7-83bf-2e1dce34e68f", "value": "4b7707e2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b210e0f2-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403809, "uuid": "20ed3cc3-4549-4fcb-a574-86f1cd49aaf9", "comment": "Malware payload (Dridex)", "value": "06ee95d9409ebb15df091fe570145d4c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403809, "uuid": "cebdc861-71df-4c8e-a828-394b0d0229d8", "comment": "Malware payload (Dridex)", "value": "49d993f564ef1f0b0c733581f1be697c27de407c0f2ee487a3c106d5540bab66", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403809, "uuid": "8b520505-655f-44da-bf21-21eefa9b42ef", "comment": "Malware payload (Dridex)", "value": "fbd417abca8489a7fdfdb79d05ded9070b57d04a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403809, "uuid": "b7cc180f-b5be-4a8b-9dc1-49ad508e07b7", "comment": "Malware payload (Dridex)", "value": "56075697a4224f65df7bb50a5d53c638e0b759f684949fd76a568be2275063d00b25b0f1ecb37d1d53c1cc9da7b18b04", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403809, "uuid": "c43c5bf4-7c67-4587-a0e7-7e51f13333ca", "value": "E7F3D081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403809, "uuid": "289b47cc-2654-4d1c-a34b-93f192147e25", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403809, "uuid": "d4961666-ca45-4dcb-ad2a-bb23d7749a19", "value": "3072:8BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHcY:IuXLcclWEc2HeSjNjGde8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403809, "uuid": "8636e90e-297c-49be-8865-e93fbe9e157b", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403809, "uuid": "1f6ff03e-2c68-4ef6-9625-10a21e15fdf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403809, "uuid": "af8d7d1b-35fd-4402-89d7-73f5f11800e9", "value": "06ee95d9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751d5f02-aee0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620356462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356462, "uuid": "80608e85-4b50-4a9a-8d1c-b816c10a7317", "comment": "Malware payload (Dridex)", "value": "9947490ff833c5b54821ccf7f50ad03e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356462, "uuid": "a424ecdd-47b9-460a-a0f0-62f9754a2735", "comment": "Malware payload (Dridex)", "value": "4a0c48866574e24d80d0a1c458f787f7516ce48d0b61215a882e928d6069fb50", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356462, "uuid": "b3267b2d-6fc1-4796-b729-d84699d4bd36", "comment": "Malware payload (Dridex)", "value": "6372168d0452a0f3f10f5ab7a02523f2a820e1a8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356462, "uuid": "5010d98b-c6d6-43b4-a52d-f31895765730", "comment": "Malware payload (Dridex)", "value": "6f914f76a757c12b48b5d5843371150dcc5ef55da18752a3e53110b499a591929531058fb38db84baa62cf48ed41e824", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356462, "uuid": "86f06147-3827-4de3-b9ee-2f0629b33299", "value": "47F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356462, "uuid": "b441eacb-f05e-411f-83c3-bc66214c90b3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356462, "uuid": "184eac7c-caf3-496b-bbeb-a9186dd9951d", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620356462, "uuid": "7d16642e-7570-4182-a862-65f84b9158f8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620356462, "uuid": "1a37c1f9-9629-4c4a-b5b3-9991f07aa892", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356462, "uuid": "01959e9b-d526-4bb1-8463-8d0797f6bf8f", "value": "9947490f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd928be-aef3-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620364775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364775, "uuid": "ffcb9408-add3-493a-80cb-183cfe60c1a0", "comment": "Malware payload (SnakeKeylogger)", "value": "b7f346e08a59ff0612b9c42713b984bd", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364775, "uuid": "1cef13a4-feac-4b3f-bd4f-887be79b0f85", "comment": "Malware payload (SnakeKeylogger)", "value": "4a46677d63fcd885bac9a1fd3aefc41a856dc527af989f116faf9c7435218e44", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364775, "uuid": "333c1721-6e33-43a1-ae0f-1ac93325a784", "comment": "Malware payload (SnakeKeylogger)", "value": "dea51226ba40473199d80d6e59ee53b76ec24dfe", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364775, "uuid": "e8b9df23-18f2-4657-bda0-d8beddf7562b", "comment": "Malware payload (SnakeKeylogger)", "value": "d048631e598a3678122747d1a06049accc2380fc98a7e94727d14c7f5a3fe2920c67cd5f8b7e10ead22b91b604405ea4", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364775, "uuid": "4445d663-f08a-45d6-8954-183cf29269c9", "value": "B1E423D148428B09DBF095F5761ECAE53EF23FEA95ACE2341DDBC13764A85A1309CE06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364775, "uuid": "0e8569a0-4e43-4726-acb6-0730337da529", "value": "12288:KKZfVSXemEX1w53ocXQV3WEqVyZrSZjOjHrjI+C/n6FNM1Y0FfIJi+ddV:Ksf4umEXCRxXoGEq6ShOxCCFi1YEf6ie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364775, "uuid": "78bcc8a8-2736-40dc-a0d2-381a42b600c4", "value": 659789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364775, "uuid": "2744f999-11c2-4311-91f3-b7ac9343b332", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364775, "uuid": "293c8f4e-cff3-4b04-b1e8-7d4bbbda40a3", "value": "Commission Invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508ac8f4-af69-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1620415242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620415242, "uuid": "9b163319-4bc3-4b23-b93c-bdc8c132f912", "comment": "Malware payload (STRRAT)", "value": "3b098ed6aa7c3b342772a135129afebd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620415242, "uuid": "c6991caa-862a-4b0c-b02e-e8bf99277044", "comment": "Malware payload (STRRAT)", "value": "4a4a333147eb03fa0bfb7d0f03b37585669e4d056d63d31beecbb56eafc80c91", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620415242, "uuid": "5e8354c9-a773-459b-a257-6f98c150c003", "comment": "Malware payload (STRRAT)", "value": "f5b5e634b40d0a043c77f48a259dab9b5eea1f5b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620415242, "uuid": "55c18e3f-4a3f-45dc-9388-2dda786d8099", "comment": "Malware payload (STRRAT)", "value": "91631da3d905b22bdeba0411bc463c6291ae9c218e44e01a11740f153dea65acea782b8f94d3b7f6f3c1763e963ab10b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620415242, "uuid": "a22054fa-6db4-4373-be2f-7d466e0fd49b", "value": "DB93CF1B3DDA95D6C007593319448327EA0D4AC8DD1AA80F6AFC47A51EB8C6C5F06EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620415242, "uuid": "d1bb5711-0daa-4667-a546-2d57f695eeea", "value": "1536:EQLmoKjSXJwjINhkq76Uju1WVFXURsZUt8mXIsruuSuO8cNFgD:Ek/wMPX8sZUKhRuO8cNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620415242, "uuid": "b860821c-37fa-4c66-a1a8-9a8182306b72", "value": 90596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620415242, "uuid": "472914f5-1c1a-4f4a-8ae7-69ff67527c0c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620415242, "uuid": "b41bf313-2651-4a2d-befb-8d3a775fae4b", "value": "BANK DETAILS.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52f3c77-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407304, "uuid": "0f941fec-e6c1-458a-b431-4c30ba9455da", "comment": "Malware payload (Dridex)", "value": "2937d9de2af5471f10e9e279402c67f8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407304, "uuid": "5da42a9c-a879-48b1-bd61-9a74a60727d7", "comment": "Malware payload (Dridex)", "value": "4aa823466cf111cd0053865c03831de96c93c4029627183ca127b4c9a57dbce9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407304, "uuid": "52a24de3-86b3-4a8f-9e5d-0e6cf816fc56", "comment": "Malware payload (Dridex)", "value": "8480bbb270e3802436a5e958be2d22ab76b3d9fc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407304, "uuid": "98d9a0d2-f0af-4643-855c-60dcbf369c9d", "comment": "Malware payload (Dridex)", "value": "784354ba88f064fea8ab118510c56c7b05638ed30c22dd70c5a9d5d7cd65adc94306552e6337f0b3904fd79b67c45c57", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407304, "uuid": "c9f54e67-8e82-49e5-a621-d89d8dc87e8b", "value": "6FF3D080E78ED5E0FC075B333E680EEF52310087691954E4EF29DABDD5BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407304, "uuid": "4122c017-80df-4a9a-a131-3689f6201ebc", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407304, "uuid": "910a5e84-44be-4537-acb8-d8ad5d334d1d", "value": "3072:NBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHj8:juXLcclWEc2HeSjNjGdeD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407304, "uuid": "a268c548-862e-4adb-accd-b8eb47b82abf", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407304, "uuid": "5f629f0d-dc02-46a6-a915-5e317f7ae9d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407304, "uuid": "2a89b266-c72c-4f49-aa59-1dd9270cd4d7", "value": "2937d9de_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be66cf6c-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620385361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385361, "uuid": "c42f85ef-6417-4230-8f37-1ce45549398f", "comment": "Malware payload (Dridex)", "value": "ef5a7c9e6d80e93a975a6a3ac549f20e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385361, "uuid": "7bdad840-038e-47b1-b00d-65ce4f6abb99", "comment": "Malware payload (Dridex)", "value": "4aa88effeb3bdca1425cd9516b45982aa4ed3c2e1b0554e60a4202700182d24d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385361, "uuid": "a7058f56-a555-490e-ab7a-9393b0fbdf5f", "comment": "Malware payload (Dridex)", "value": "ab55269a2caa828a52bb3a530edf659632ec98f0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385361, "uuid": "7776d473-cc7d-4a80-92ec-1bc0b82d8b1a", "comment": "Malware payload (Dridex)", "value": "f419238c05ed614afe8e90c0b4bea21065c88ab552220e120f042067e8a2da624231c0c1b062054eeb9fe7efbef14386", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385361, "uuid": "a048c798-cd11-4399-b4b5-e5d5a3c9a0ab", "value": "97F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385361, "uuid": "92ee793d-3a6c-4ad6-b389-fbde45938540", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385361, "uuid": "a824be38-b84a-4677-8107-46137a1d3514", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385361, "uuid": "783f2c0f-2a14-4ad4-a589-71f9572b92fd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385361, "uuid": "f93c06f6-9d08-4315-8ec3-a9db600c5d33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385361, "uuid": "ca91fc59-488e-42d0-9238-80d59cfd210a", "value": "ef5a7c9e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e1db7e-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404060, "uuid": "735f689d-2eea-40ea-8c14-670596bbeef8", "comment": "Malware payload (Dridex)", "value": "002a40260eff717581bccd276c80ddb3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404060, "uuid": "87277b2d-17ac-48b7-9811-296153ec421d", "comment": "Malware payload (Dridex)", "value": "4aab005618b2f80b8687cc9f4749c42146a7cb8e5f0834f8ae51e7f0f62d691d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404060, "uuid": "9c1d7471-bfda-444c-8dcc-3253e10a8674", "comment": "Malware payload (Dridex)", "value": "67fdddc801811fa7ae20970d6a8b7c7bb3fc00b0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404060, "uuid": "1ff8eaf7-2524-41ba-99d4-09e045c9947f", "comment": "Malware payload (Dridex)", "value": "546f416634faf04db9c97d333319069da85b6f811fe5fe0edde5cb0fec1f35c1355ec16000ac699f415f04416483ad50", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404060, "uuid": "36d95d9b-5237-4977-831b-37aec54fe5da", "value": "08F3C141C9C5CCF0CBE36C3A4695963B3228B941995A8E42EC64CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404060, "uuid": "fabac70f-5288-468d-9589-f58619972258", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404060, "uuid": "b00bf7cf-4290-43b0-a5f9-881ca8ce5b91", "value": "3072:PuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+5d:P0czbty9uiaJlwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404060, "uuid": "05052e63-62f6-4e33-9866-83b7c29482f0", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404060, "uuid": "2ea2ac6d-5454-4d81-bcfb-87ff50c62f71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404060, "uuid": "a7bab215-b6a2-437d-bba6-b9ed54c4c69d", "value": "002a4026_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3aba507-af7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620424884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424884, "uuid": "bd1c73f8-301e-41a2-acd0-aa763a59f604", "comment": "Malware payload (Dridex)", "value": "6c34738660f999bec944b757854710cd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424884, "uuid": "5431f4f2-c788-4351-aedb-6945015c83e1", "comment": "Malware payload (Dridex)", "value": "4ad70169cefe39d010b6a0987ce5870b20ec3a293031b08fcd67019a3d8a9a71", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424884, "uuid": "f57fc1bb-51bb-4270-b99f-229298c67aea", "comment": "Malware payload (Dridex)", "value": "ec50a5a61be095c681fab846f503cadd2c2fcbb5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424884, "uuid": "31e7ba45-9ed9-4e43-af7a-147434279f71", "comment": "Malware payload (Dridex)", "value": "58cea0b8180330546041a944a87024bfbc905167c16212f65d6871b39176fd37e107525339d1e42baea4714521cdf194", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424884, "uuid": "9853b046-3f27-481b-b2f4-f3ee39604b7d", "value": "29F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424884, "uuid": "78fb3e56-3962-4a93-be5b-43ca78fea694", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424884, "uuid": "afbc40da-3514-4c25-8fdc-8c59515589cb", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620424884, "uuid": "7685d4cf-e4fa-4b37-82dd-de7175873250", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620424884, "uuid": "d48ea544-50a0-427d-ab40-f71f02712266", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424884, "uuid": "77b44eb3-e245-4fa2-9f06-05e882789fbb", "value": "6c347386_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e1cf3d-af2a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620388214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620388214, "uuid": "ab68af97-1c50-4459-8cbb-44e824f61896", "comment": "Malware payload (IcedID)", "value": "e63214b520465927432a040ce7cc538c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620388214, "uuid": "861a431c-d984-4b80-879e-3035144de3f3", "comment": "Malware payload (IcedID)", "value": "4af51e1230519e63f96e7dbbbd8b688575bddd2c33bbf34e1638dd6dced9f8de", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620388214, "uuid": "9accdc04-f96f-4eaa-a2a9-25cbe066b534", "comment": "Malware payload (IcedID)", "value": "78b50b0f796dea283e707dcb3a5a547b7c67af2b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620388214, "uuid": "58c093bf-085e-480d-875c-9e3502fa3a88", "comment": "Malware payload (IcedID)", "value": "57ce458e52ff88fd019178e3dcd4a1573c4f6b3c6319a67faabc8750afe04557595124b830e48dd6391d9d2c42a953d7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620388214, "uuid": "e18ec298-e348-4812-a79a-931505e8cc54", "value": "79346266C598D1BCF2476871357CAB58C550AE80AD12DDE3FAE6C412AF239B123213DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620388214, "uuid": "314177b1-1683-43a2-84da-a22f2b10115d", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620388214, "uuid": "9bed8b3f-46ba-43de-a9bf-f8247705fd98", "value": "6144:dJJLaU1mUGduNzGSijExi3oomlnG9PS9sfr8mnOySgEBmvpmCZdXWdyqL28888IS:dJJLaU1mUGduNzGSijExi3oomlnG9PSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620388214, "uuid": "f9cf959a-c0bf-402b-8385-65dd17c70488", "value": 240216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620388214, "uuid": "3567f936-9f29-43de-a8d2-c00479eca911", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620388214, "uuid": "a3bb7824-dc0d-4d4c-8992-624f8fbcf236", "value": "4af51e1230519e63f96e7dbbbd8b688575bddd2c33bbf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b42c2be-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407207, "uuid": "a221f842-1d25-46a7-a3cd-39561fb1dbcc", "comment": "Malware payload (Dridex)", "value": "07a09b14819a9428ba29ef877244b786", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407207, "uuid": "efea9d27-405e-4200-9710-545bf776d857", "comment": "Malware payload (Dridex)", "value": "4b14342764c025fd64fb5fe6fc638c60b1ad6fb9a75585406d4e903c1fc0e84d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407207, "uuid": "7db71799-8e56-4c8f-bbcb-481ee7e5aaa5", "comment": "Malware payload (Dridex)", "value": "2511e47e258bbae9b4c302c23706cb3d2aae12bf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407207, "uuid": "90c0b1da-1ee6-4f65-a664-f15cb49bb9de", "comment": "Malware payload (Dridex)", "value": "bc15a68fcb10439c1fa2028a8fb8d392129e2cd963aa15a1035259ddd02086bd064557033c6bf0425f96a3001934adbb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407207, "uuid": "823cea95-759f-4a01-b342-aca68531d61c", "value": "9CF3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407207, "uuid": "85ddc169-5558-4d82-8291-4717c55cd64b", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407207, "uuid": "226378c4-b2dd-486c-8900-494450bd5e67", "value": "3072:vBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHSa:5uXLcclWEc2HeSjNjGdeya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407207, "uuid": "84225f7c-0419-446e-8720-ac1d332b32c0", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407207, "uuid": "90b803ec-b43e-40db-a8f3-7a2eb8db9968", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407207, "uuid": "6ff56383-af26-402d-ba0e-871de78c8fed", "value": "07a09b14_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8de4049-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403794, "uuid": "3c338a24-1ee3-40db-b905-ddaae0df7fd2", "comment": "Malware payload (Dridex)", "value": "cbd986ffc183a66fe472ded479a9d4f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403794, "uuid": "d74e3c1d-f993-49b7-a172-dbb7e18bbf0f", "comment": "Malware payload (Dridex)", "value": "4b4fdec314afa1c77aeb44da8cd0bf6c2a7d645049fc1cf427c0455a33e18e42", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403794, "uuid": "3bbafd5f-66c7-4e00-b267-699ede93cc2d", "comment": "Malware payload (Dridex)", "value": "896a359f54672b3afcf2f5e45e2870efa2695b5b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403794, "uuid": "1bad7253-2b1b-4d8e-9b54-39322953a0f6", "comment": "Malware payload (Dridex)", "value": "5203765113b0f1cc4adc7b29e1fa6cadc61c99ca93db8001f306929bca49d61d488fc4f2f42d5d95fffd1f05f71d9072", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403794, "uuid": "d8014c43-fd87-4606-9061-49a129d31f7d", "value": "9AF3D040E78ED5E0FC074B322FA95EEF5631008B692494E0EF29CA7DE6BF7A19164714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403794, "uuid": "6752b829-792c-4c30-931b-58db3528bf67", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403794, "uuid": "0c6b747e-8603-4d31-a6d5-0b31037380b3", "value": "3072:XBoQctVOM7/8wZQvUlM7xNjztUJQ8eHcY:RuXLcclWxNjGde8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403794, "uuid": "472118ae-5df6-47b4-9ff5-2e4ee398488a", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403794, "uuid": "fb0f3a3f-4e8e-46d5-af1b-9c46754a4eb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403794, "uuid": "cace5979-bbc9-48a0-a547-a6b86b1a3da8", "value": "cbd986ff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc27f87-af7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620424877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424877, "uuid": "e337fcfe-f219-4106-8933-4f5a3d19a375", "comment": "Malware payload (Dridex)", "value": "6a7eac2bb6057feec28949209938b888", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424877, "uuid": "4dde747b-cbec-4ad0-95e7-9da32b0b58ba", "comment": "Malware payload (Dridex)", "value": "4b5d1ef0df969ee88f59eb6f5297e685d8ec7a2203f877fb886455ff8868be43", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424877, "uuid": "04967634-a0d3-4e1b-8bc2-24671bf3014f", "comment": "Malware payload (Dridex)", "value": "bbaed2f43068d790cd45879c33a2b5bea2ed1239", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424877, "uuid": "e46c1938-f2c2-4389-8c91-d7bbb09d39fb", "comment": "Malware payload (Dridex)", "value": "d0f167b78aa7687b52d43b714c481cd0874e01c6745e6ee9a74e4b79629e3b77fd35edd47f61593b13d33f282fa87584", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424877, "uuid": "bb5414d4-57ca-42bd-b183-d5ec8221f6bf", "value": "1BF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424877, "uuid": "6444d426-e0b1-4b04-960f-448f47693fe3", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424877, "uuid": "e2b6949c-3ffd-44ff-a7a5-3213ccd3f9e3", "value": "3072:2WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:242IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620424877, "uuid": "e4a199fd-0e1f-4d26-a2fa-d2e48a324cf2", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620424877, "uuid": "addbc69c-4109-416d-95d5-bf649c81d580", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424877, "uuid": "d90758d7-6158-47c7-b70c-74fbd727dc7b", "value": "6a7eac2b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c77da27-af3e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620396686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396686, "uuid": "cf879738-2751-40fa-9c19-e9e4d25f9b00", "comment": "Malware payload", "value": "4a9f1d5f99aaf91f36ad1069d14b915b", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396686, "uuid": "5fface2e-e484-4920-a23e-1f7ed0a1a162", "comment": "Malware payload", "value": "4b77c1841b4e42392ad92d1fdd376a1dc2d0ab526c25c761fa1daac9841c4746", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396686, "uuid": "6a9b6d81-5878-4ed7-b9b1-767a30af7e74", "comment": "Malware payload", "value": "52e6c2e9d3d674da28df0dc1ccb860ee7ad4984a", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396686, "uuid": "ea845453-3812-4577-bc50-fa9f637669b3", "comment": "Malware payload", "value": "ced98c456c3ce11e93cd48b3638dd4462ccc9c5f3e839c3698c21321e45e552022923f177808782273bb55e71d13692d", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396686, "uuid": "b7158675-8636-4592-89f1-3a1025473cff", "value": "994171CA131302743D65A72E61B7000836C3E1AA64CD6ED2D7FC3BB94A5CF58E869F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396686, "uuid": "dc9a3504-b5c3-4926-838e-bbe532ad75bc", "value": "48:Ui7j1iI2aib5Jjifhim/iz79iI/i0NifM8witNiQS:Ui7hiIzi9Jjifhim/izBiI/i0NiU5it4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620396686, "uuid": "b6300e07-cf17-4e6b-b7a7-fa66697048bf", "value": 2124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620396686, "uuid": "9122d35b-5dda-4253-aeb7-838120a50952", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396686, "uuid": "fb216cac-da6a-45d6-996c-cbb78a2adedb", "value": "4b77c1841b4e42392ad92d1fdd376a1dc2d0ab526c25c761fa1daac9841c4746", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a2885d-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407258, "uuid": "51c37751-86ce-4188-9148-f0898c7debaa", "comment": "Malware payload (Dridex)", "value": "b31685bf14bca7e89957f891889d47ed", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407258, "uuid": "b2838720-23d5-47b8-9d1e-f58ea7c09856", "comment": "Malware payload (Dridex)", "value": "4b81dc0e2163d8dca09c378813086264423f1535a47a17cd4075be5477389461", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407258, "uuid": "a2c8a9a0-847d-42d3-b635-5065eef414fc", "comment": "Malware payload (Dridex)", "value": "59b861bc6592e57a85ac965642eca021cdf0d606", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407258, "uuid": "536bf31c-fa80-4153-929c-77dfe49d3ddc", "comment": "Malware payload (Dridex)", "value": "0122ef901f4a9334a4d62c0b08f5ee0e7d7815912212f1ffdb942735d3ef089fd011861a5fa528f7b070c77bedce48bc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407258, "uuid": "8dc0de66-4a36-417f-9a25-22bf2c6e18f5", "value": "B3F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD5BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407258, "uuid": "0a957a11-a615-4f80-8619-9eb996111bed", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407258, "uuid": "d258d379-67ac-431a-91c6-610e7b68b79e", "value": "3072:sBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:YuXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407258, "uuid": "2bfc818d-cc35-4a34-bf51-a25ae43ff7af", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407258, "uuid": "48e32b5b-c15e-469b-87b7-0e2fdd4be768", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407258, "uuid": "a75ff8ad-ac8e-4ad9-bd71-5ac0cb7abc4f", "value": "b31685bf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6591ee5-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407333, "uuid": "a1afcc65-9ec9-4f87-af44-1788f82026f4", "comment": "Malware payload (Dridex)", "value": "9a52321aeff8a8252f20d27b05ac1c77", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407333, "uuid": "15169c6f-93af-49ae-946b-a65201ab0d08", "comment": "Malware payload (Dridex)", "value": "4bc5cff838df9d73ef91d7330c90c51b292d8c06f262d886590daa9c7c5408ed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407333, "uuid": "00aeb4d7-ac9e-47c2-b1cb-f53000400ac6", "comment": "Malware payload (Dridex)", "value": "33449987c7c0d805e6763b0ca8355a28c6a2e841", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407333, "uuid": "77a9af62-d87e-4894-8f88-727c7ead0fa2", "comment": "Malware payload (Dridex)", "value": "f225899174d888a4be241f3f29d83893dba10a50ac3c76a70aabe2ffdea94047ee7f0d9132c69e52d3bff268618ccc83", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407333, "uuid": "a6b3246a-bbe2-489d-9f51-45d76a65fb21", "value": "5FF3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407333, "uuid": "4b05f56b-cf7e-442c-8fb3-bd58e768419b", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407333, "uuid": "71b561da-c95e-462c-b2ea-3eefb17b0969", "value": "3072:oBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHqE:suXLcclWEc2HeSjNjGdeKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407333, "uuid": "588d1a12-92e1-435d-9bf1-1e9e939aba1c", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407333, "uuid": "333f68c9-5d07-4685-a006-805e451987d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407333, "uuid": "c236f8a9-8d31-4ccc-8acc-b2ac6f00a43c", "value": "9a52321a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97055e5c-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620385295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385295, "uuid": "8272df76-260c-4698-a602-3d60b5eacccd", "comment": "Malware payload (Dridex)", "value": "fe2c6b793cbaa56748a62665452b37d1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385295, "uuid": "e1cbb48f-2e72-4a0b-8359-8d21c935aafd", "comment": "Malware payload (Dridex)", "value": "4bda857dcde2e0a81bf0df72f4b5325da95eb38a0d0938469d90dd3db151519d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385295, "uuid": "cd3db63c-241a-40cb-b93b-336077dccc19", "comment": "Malware payload (Dridex)", "value": "f74af82ae08af58e060bbf2fb9b0d0e918b5ce9b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385295, "uuid": "24661414-8dca-4228-89b3-46dc9b399692", "comment": "Malware payload (Dridex)", "value": "a0403935d85a5786d0caea940930df000bc7e8f1c03c0565f62b5856a9d030bc7f509f0bfa6697fa7c085230633a3467", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385295, "uuid": "2533abf3-16be-4536-b0bb-fe87444a7a37", "value": "88F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385295, "uuid": "3670d6a0-b21d-4c49-813e-83cbeacd4743", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385295, "uuid": "34d79f25-5480-4a50-9a02-38f073b790d3", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385295, "uuid": "a0cd4d6f-a59e-4f97-86c9-64687bb5315e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385295, "uuid": "2ad44752-6778-4b27-9e51-9a909840fc4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385295, "uuid": "83b6448b-8e87-4582-9657-2a775ec26f35", "value": "fe2c6b79_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8e1475-af0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620374487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374487, "uuid": "866aaaff-9a2c-4f46-b577-591bdd4cc93e", "comment": "Malware payload (Dridex)", "value": "0d593213ee21c0dd0123bde7f4f55758", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374487, "uuid": "d68baf0c-f711-47eb-9a5c-9c2f38e4adb6", "comment": "Malware payload (Dridex)", "value": "4be6e187c89c0e5fa57b56ddc38de105029831798a9ecfd61776246b1a4caeb9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374487, "uuid": "141d87fa-bcde-44f5-af2f-76782662a754", "comment": "Malware payload (Dridex)", "value": "2f2e24d5634a40a5951ee71f6e0f36a0914c4953", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374487, "uuid": "228c95b6-fff3-4c69-8124-2bda35071762", "comment": "Malware payload (Dridex)", "value": "52690cc0ed7bafc91ffa85ca1c8b342e97a3d93111822a7687681ecbfb5d7fc0ebbc45992cbb5441714cd99654fb44b5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374487, "uuid": "8c6b3cc0-642e-443f-a12f-60787584c5a6", "value": "9CF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374487, "uuid": "3073a048-5bef-4117-b95c-944e9f23b2d0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374487, "uuid": "9dd4e185-7301-4240-9d94-918d87ca632d", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374487, "uuid": "28347bcc-3c39-40c1-b34a-8c75d8a3a60a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374487, "uuid": "ba51e1ef-b6f4-4808-9dc6-1ad52989b353", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374487, "uuid": "8f5d4c2c-ea62-4292-887c-5b34f920c307", "value": "0d593213_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be64c42-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407181, "uuid": "e66c40e6-f74d-4f33-ada2-cdbd6e8dc77b", "comment": "Malware payload (Dridex)", "value": "6414ca18b7425d2a5a6ea6aa42409e6d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407181, "uuid": "425a88c6-6405-4607-9844-b55a7b3fcefd", "comment": "Malware payload (Dridex)", "value": "4c3889c5e31f80a2ed3d3d0f91f7b3d39bfdff8846d958c3e256bc96b277190d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407181, "uuid": "5139c218-10b0-456c-b274-0cb1e05df79e", "comment": "Malware payload (Dridex)", "value": "12e3ae34f1cbfda6ab8cd6c11e0136b7eff772c6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407181, "uuid": "875eca98-c69b-4c1f-807b-f46df8276f54", "comment": "Malware payload (Dridex)", "value": "e45b06688d2bcd098022ad1d386327e8c85305b42c6ca4fcbcde3ba536fa08abcf4f1e200439ad52fe07e33ddbec833c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407181, "uuid": "c5b1468b-8a32-4e31-b2eb-5e45f434be9b", "value": "B1F3D141C9C5CCF0CBF36C3A4695963B3228B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407181, "uuid": "7d663ad5-333b-4320-8e7d-06ad5b8050cb", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407181, "uuid": "7e1e0e0d-c313-4bcd-b97a-189d676696c8", "value": "3072:tuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+eE:t0czbty9uiaJlHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407181, "uuid": "eac1390e-b229-488b-8b7f-e1c4dc4c6f53", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407181, "uuid": "b1823a3c-5fa4-4c8e-8fec-28bc8fea45f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407181, "uuid": "f3031f2f-e968-4a5e-b0fe-fe421707b925", "value": "6414ca18_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795e3fa6-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403714, "uuid": "ded1692c-a7ca-47f4-bbff-b0abd01fb961", "comment": "Malware payload (Dridex)", "value": "bdb40c6911656fe25b1a7d08aa504d2e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403714, "uuid": "3a66a071-89af-4c4e-b0bb-0026dbce3607", "comment": "Malware payload (Dridex)", "value": "4c4f175c25e5ff247276d46a985f2adc714ea94078d1774e48b42583c2a7bce6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403714, "uuid": "76c62f24-4a8e-4414-b199-685400775005", "comment": "Malware payload (Dridex)", "value": "cf40fdce004fea7252f181d00203269694bca6c5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403714, "uuid": "80560e5c-2ad7-4a5e-b7a7-c259b046c547", "comment": "Malware payload (Dridex)", "value": "1e4ad6bebaa6fdac888ed95c788911178cdce19c9f30a87838fb711b3f4c15c410dc411f45688d3637ca8ea294f54264", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403714, "uuid": "77455460-3a62-4fa2-b31d-cc31464b5953", "value": "B4F3D081E78ED5E0FC075B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403714, "uuid": "e312a71b-cb2e-4707-beae-68d46b251ec3", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403714, "uuid": "755c05f3-a158-41b5-9639-8cf96ac09420", "value": "3072:iBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHN5:iuXLcclWEc2HeSjNjGdet5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403714, "uuid": "3df65583-2a5d-437f-b80c-346211f1cb8d", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403714, "uuid": "52d44f2d-a36f-4dc3-9230-49d2f4235773", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403714, "uuid": "38d3c2be-7689-4ec1-bc66-83c92aa0e4a3", "value": "bdb40c69_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc470ce4-af11-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620377627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377627, "uuid": "b22824b7-4958-44a4-848b-914fc34655be", "comment": "Malware payload (Formbook)", "value": "bbe5641d7a7fbbe17e103522c9ead66c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377627, "uuid": "9ad5696d-918a-4121-bb30-4f18f8d3fe0b", "comment": "Malware payload (Formbook)", "value": "4c6e43c5746182cb3cf7e928fda456101b27c8c4d277658540912500d4b06239", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377627, "uuid": "f425b86c-31a9-4aca-b6b4-795ff4acaa2e", "comment": "Malware payload (Formbook)", "value": "74fef268b5da950ffe194927129c707c37fd7347", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377627, "uuid": "92d11d51-bc18-4685-b9a9-fe8e73871584", "comment": "Malware payload (Formbook)", "value": "9e18972999a89f92180dc88184d51a7c8905978583c9e928cd5fd3b5011fe2b9ec59e88c19ef1dd2960ae3627fbc3449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377627, "uuid": "0c446deb-1cfb-4c82-8abb-3a59eae7e5f5", "value": "62E4D02453549E8BC17F303E6060C125A3F4C66226D2EB893FE055EA7ED6FC1B7592B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377627, "uuid": "d255ae44-1f43-4324-927b-b942dfa24d5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377627, "uuid": "7fc70533-9336-45d4-86f3-03777be57eff", "value": "12288:uLs7cTiVenUFzNMyWWMSjSXeXVyPsw5G+pjWZHOUMHcnWYTl/:Ja4b/eSoelyPs3+UZHOUSOWYTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620377627, "uuid": "12275121-7374-4a74-9832-5ffe85a8e06f", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620377627, "uuid": "c9ba1079-af55-4deb-9fca-1195a6a9f6e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377627, "uuid": "3eaf3ba9-85bf-4369-80ae-ffaa58d3b914", "value": "GLqbDRKePPp16Zr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ebe73d-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403604, "uuid": "99b1391a-d24c-4db9-afb3-1dcbe26f163b", "comment": "Malware payload (Dridex)", "value": "e72ca2bd3e729ff02c020e50811e2824", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403604, "uuid": "99678588-0b10-4946-b976-f41a5939ea2d", "comment": "Malware payload (Dridex)", "value": "4c6e4cda8315339b6b539da3bcdbbc811d041fd3bf47fb92d7a0400c24f4806d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403604, "uuid": "21d10818-f22a-4723-bd6b-225eafe553bf", "comment": "Malware payload (Dridex)", "value": "bd82fd29ddd3786a00a283e8ab32b91aecd0e1dc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403604, "uuid": "0690ecd7-ff7f-46bf-b03e-ccd06148b549", "comment": "Malware payload (Dridex)", "value": "7628dbbb90e77de2093cc6af3aeb00705aeb0c2f1e33492f39c87bd6f18f371ef4ac77dfdabb0879d19594ee1f4d27da", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403604, "uuid": "c7643e4f-438b-49fe-bd6a-4321ffd47881", "value": "B5F3D141C9C5CCE0CBF36C364795963B3628B941995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403604, "uuid": "601a5909-3ec0-47af-b512-9e8df0796d0b", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403604, "uuid": "5246adbe-9cc3-4600-aa86-780ebb5179fc", "value": "3072:HuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+JU:H0czbty9uiaJlcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403604, "uuid": "353cebe1-91c6-440b-9202-d5f894a3cd2e", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403604, "uuid": "c824d1f4-8a71-4136-8053-321b60d12c92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403604, "uuid": "84d379ad-f350-49cd-b2ca-1e1aba45e342", "value": "e72ca2bd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8433b736-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407168, "uuid": "e6265d9b-9398-4738-8df1-6d020ca64995", "comment": "Malware payload (Dridex)", "value": "e4075f0bf0715be2b7479799f6aac3f0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407168, "uuid": "925f3cd3-e50b-4e74-837d-c624b296cbf0", "comment": "Malware payload (Dridex)", "value": "4c8a0610501f9596c8d71008729441c18ab8e7826b662b507a82824a2bec733f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407168, "uuid": "d8201b29-ad2a-43e6-83c6-09d2c29bdc81", "comment": "Malware payload (Dridex)", "value": "05a9b2def8ce6c7295deeb3820f9e03a96a1dc3a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407168, "uuid": "72263ce1-b1ef-4054-9100-7611957b9194", "comment": "Malware payload (Dridex)", "value": "7a9db82d55da7092018a963528b844967d32e1d8edcc2cf7b64ca3bba5e4b7a3098e30386150f7dd369f29208a9e001a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407168, "uuid": "13db51c1-506e-4e75-8e72-219067f8f1ef", "value": "A8F3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD5BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407168, "uuid": "f3989e90-9631-4977-8e29-c651cb28c659", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407168, "uuid": "c51d5aaf-f783-47d7-9828-75d79a3b3f61", "value": "3072:UBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHj8:QuXLcclWEc2HeSjNjGdeD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407168, "uuid": "3cea83fe-97e1-44da-be0e-bbc4a7e45151", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407168, "uuid": "2b73b8e4-6db2-4b3d-9e01-d8693dd25f5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407168, "uuid": "5ba9ef6e-6041-473a-9e84-e945dd2fadf4", "value": "e4075f0b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9cb85cb-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392226, "uuid": "16df3251-691d-4a89-a378-db434941c58a", "comment": "Malware payload", "value": "233d7af52a31751c0931257f63eccd6b", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392226, "uuid": "8402c9c8-4799-407d-89e2-e93954b9d947", "comment": "Malware payload", "value": "4ca3fba7ed8c15640e5b5da61c92f53235d19627e674e7c132fc927e23434970", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392226, "uuid": "196a0509-17c3-485f-8d80-d6cbbfdc0515", "comment": "Malware payload", "value": "9c3b624c3112a5806018fdbbfa87be1a0fac7de9", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392226, "uuid": "a9bb28f3-d7a8-4b64-8a4f-01a44be261dc", "comment": "Malware payload", "value": "a1575e22ac4f592e18873daa30631312fee0ccfbbf9d37c5f13e05348cfb371d29ca9c397849615712c2c44d50b8174a", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392226, "uuid": "23441dbd-cdd7-426c-bd73-70f1aa8801bc", "value": "D841429751A70B346DA1A91B33ABD43430D0909F59D69F8768EC3CE5C8CDD84AC48BD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392226, "uuid": "cb1e29c2-636d-43b3-ac15-f472d8ab6bdc", "value": "24:vvePjxUjZWFOJztreRZXcHITKzGYjrip0lkEuKYjzSzh:vvePuWqztreRZDuzGWGpsdWzSzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392226, "uuid": "d24aab5b-798c-4274-af86-3c10ba2f0eca", "value": 2085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392226, "uuid": "ebc01ba7-f428-4d20-b6d2-9bf0e5321888", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392226, "uuid": "5524a4df-27ab-4fd6-b548-73a0a483a890", "value": "4ca3fba7ed8c15640e5b5da61c92f53235d19627e674e7c132fc927e23434970", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4086e703-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403618, "uuid": "981eedb7-dfc8-48cc-837a-bd3b45276dcc", "comment": "Malware payload (Dridex)", "value": "7252c97f96d69c93af37ed3a0e78eddf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403618, "uuid": "86a8bf5a-3809-48ad-9c98-d3d99d447161", "comment": "Malware payload (Dridex)", "value": "4cf3a2e9fc618911881f2836c0fc3f16110d8f062b378db1cc76a86f69b23001", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403618, "uuid": "cbbcf5c3-3abf-4ded-9ff1-33db52da421f", "comment": "Malware payload (Dridex)", "value": "bd74e29342aeb847524699585b2c7657efbf8a8f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403618, "uuid": "624970af-b544-4986-aeaf-3ed3eafc3203", "comment": "Malware payload (Dridex)", "value": "e10b613ddc979e470965ebd1f045b05b236cf49a2133ac9611031c71cc7b2f878fe071373dc2dfbf1f5c72cd5f2dd733", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403618, "uuid": "79c461d8-9805-4989-8d22-e56e5ed75209", "value": "43F3D080E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403618, "uuid": "6f2c3717-20c3-4e3b-a27a-5a926b97510b", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403618, "uuid": "1dafa51e-274b-4b56-8974-4e6032c2ac15", "value": "3072:1BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHNz:7uXLcclWEc2HeSjNjGdetz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403618, "uuid": "e0b116b9-9f59-4bec-861f-ed9f2d7ab8ed", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403618, "uuid": "c23c23c8-423f-49db-8a93-f133c8ec0dc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403618, "uuid": "365abda9-4b9f-43ba-86a5-354f2f3cbe4b", "value": "7252c97f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7ee8c4-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403855, "uuid": "fd578b8f-6a35-4c48-995e-1ffa48fd2961", "comment": "Malware payload (Dridex)", "value": "a062502958f90bb127722176972a14b0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403855, "uuid": "5f65a627-15a8-449b-bc4b-5f4203792555", "comment": "Malware payload (Dridex)", "value": "4d65960327c18ae19c1eb59c73f3e4d3ead6b52b5e3d252b08581aa8a8563cea", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403855, "uuid": "ed269fbd-e19d-4692-9d8e-5d4e48e5dea2", "comment": "Malware payload (Dridex)", "value": "79d20d5c1db47b6711bf05b3a609bddd797e5018", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403855, "uuid": "9a128c8b-5c58-4bc1-9d53-e5c2ceacbfe2", "comment": "Malware payload (Dridex)", "value": "69170005bb9d1e17a053f72ea2b7f894bbb68b891f1f05804efeecc2bc3b4f78319af9704a627ba7d131e1d55b5cf734", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403855, "uuid": "9f6fb775-dae0-4779-a5d0-33596bd49c4f", "value": "69F3D080E7CED5E0FC079B333E680EEF52310087691954E4EF29DABD96BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403855, "uuid": "ebcff3e3-3606-4b1e-8593-6468c2867626", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403855, "uuid": "cf5ce4eb-6c8d-4988-9b0c-17d3988232f2", "value": "3072:dBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHS4:TuXLcclWEc2HeSjNjGdey4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403855, "uuid": "0adab018-0a15-414d-a4c8-81c2e2454268", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403855, "uuid": "dc794389-ad55-44cf-b407-898068ba9e4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403855, "uuid": "cc801656-1dcf-4dc2-9682-39c673776d34", "value": "a0625029_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecdebaf-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404206, "uuid": "d112efde-30d6-48e0-8752-14bfbe2013e7", "comment": "Malware payload (Dridex)", "value": "d27195c0ec71acc46362441e28b666f7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404206, "uuid": "a22a2f44-752d-4e69-bf20-eaa7790565f7", "comment": "Malware payload (Dridex)", "value": "4d999e8f543c09f2c72f76625082af97636c1a15d7259eae40243e040280998d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404206, "uuid": "ab09f099-23aa-47fe-8213-f947cb9879ce", "comment": "Malware payload (Dridex)", "value": "6c1bd358ff07cb83168323ae85ba653c015f074a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404206, "uuid": "6abf23b3-2415-44c3-9284-51d7dc74dc32", "comment": "Malware payload (Dridex)", "value": "b447a96f187e41a37817ccead358d0fd2a74e7187a81afb7514f1d58233aa7fb3512df2210a80e8f1a0ca4e3eeccc492", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404206, "uuid": "16681f4d-ddb5-40f7-8c5e-c4464f76ee32", "value": "03F3E081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404206, "uuid": "43e57dc8-ac80-4904-a591-15833c5e5806", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404206, "uuid": "6aef9bd6-80b7-4405-aea9-46c523e004a1", "value": "3072:pBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHAh:3uXLcclWEc2HeSjNjGdegh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404206, "uuid": "f029dd78-50b8-4529-b29d-62be676e4d1f", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404206, "uuid": "16a3ab16-4db3-43e0-9e1d-c4c729a0c2b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404206, "uuid": "1a50a66e-746e-4220-965a-6cd6d71c6ffd", "value": "d27195c0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e28b9e5-aed8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620352880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352880, "uuid": "980bb6fa-a3eb-4dca-8d9d-727f2b3e6d3a", "comment": "Malware payload (Dridex)", "value": "2d515668ff350bea73f9d160585a1b88", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352880, "uuid": "ddff447b-7224-4586-a42d-f464d0b2f5f4", "comment": "Malware payload (Dridex)", "value": "4dcd2d722cd00c6364b3c0c4577067cea38f2618b975eae20ea2174bede60892", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352880, "uuid": "b154c54d-9ea3-4cab-a099-2b5676c96497", "comment": "Malware payload (Dridex)", "value": "85c79b97880b6b8bd5504e3eaebe4dbbf7f94928", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352880, "uuid": "eb37bba3-d351-468d-b9cd-baad8d351339", "comment": "Malware payload (Dridex)", "value": "f55c9baa520ea9599dddf33a7fb2ab4113fdec8f5ddc872ad6c1db708364f698ba9b16446a669903324cbb2ffd10711b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352880, "uuid": "548df134-a89f-48a2-9fcb-c562c2310dcf", "value": "04F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352880, "uuid": "de03faf7-2064-4078-afac-f6d73abe766d", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352880, "uuid": "d4fa6572-6c84-4d35-bd67-e357022bb17a", "value": "3072:JA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:J3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620352880, "uuid": "af6e544d-0fd3-41c7-80f7-d6b142b812f8", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620352880, "uuid": "57d70419-0531-493e-8379-d83bf725aa03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352880, "uuid": "8142d96e-a863-49c3-835f-d8eacd4e55d0", "value": "2d515668_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a016fef-af0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620374455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374455, "uuid": "9e61a171-774a-4ede-aa41-0852e21adf72", "comment": "Malware payload (Dridex)", "value": "2f2e25dc299e56ff627fe11b2572fbb7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374455, "uuid": "f8d12701-4570-479b-99d1-566de8aa0c95", "comment": "Malware payload (Dridex)", "value": "4dd937bd326d6d8b93af7818b4435dcc3138b125a60791bdb8ba586ea2513b4b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374455, "uuid": "0c3584b4-225c-4e05-bd9f-fdd0030f1bde", "comment": "Malware payload (Dridex)", "value": "4177f8f86426ad12eed67b3af72fe1a89a1505ff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374455, "uuid": "9edafc31-93f1-4f16-bc88-72cd358b69e2", "comment": "Malware payload (Dridex)", "value": "f070c8bc410ca0eee3b878bbabab73ce74a2f61ac62cc74bc9143b52f84a4a25e241724ba85e3f25d2dfe9ddf3469fc0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374455, "uuid": "7ef43a26-0ce1-4628-8463-fdf8639cacbe", "value": "2FF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374455, "uuid": "f13346e8-f19e-48b4-b520-4c064c169303", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374455, "uuid": "ad3796d9-3eac-4b4d-8b8c-7429a726a31d", "value": "3072:6WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:642IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374455, "uuid": "5ff5fdc0-7380-4b50-b642-3ae39e789c3a", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374455, "uuid": "72141a7c-59dc-49f9-96aa-2253be2a9f05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374455, "uuid": "08bfd503-0efa-491a-8754-ee1dc2324cc5", "value": "2f2e25dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffeb606-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404020, "uuid": "f52e8e6b-e2d8-4b0e-a5ba-3a3799f3cf5c", "comment": "Malware payload (Dridex)", "value": "23f336126ce4611a30605a79bc0bea52", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404020, "uuid": "3a78e240-ff50-4109-9ca4-a2ce83567cff", "comment": "Malware payload (Dridex)", "value": "4e1e4bd0ad6f30f084cb1fd72e78d4d1e2fcfff81a2fe9257ba8978b3296901a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404020, "uuid": "cbf0975e-d61f-44ca-bd54-e507ff38c731", "comment": "Malware payload (Dridex)", "value": "4631c313dc43a82f27862d11401f097112b87ebd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404020, "uuid": "4d463091-c358-4e85-a64f-e4fd5de8cd9e", "comment": "Malware payload (Dridex)", "value": "4f994702e4ee594f27e315830528172e820bbdff7555174f07ee3346736fc363826970835b98f3cad1a1d8cb671b78bc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404020, "uuid": "d8bb9b7c-211a-4e26-9dbb-877cdd9c9c43", "value": "03F3D141C9C5CCE0CBF36C3A4795963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404020, "uuid": "fde2dd28-04fe-4d89-a53a-9d82df537c17", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404020, "uuid": "af1a30aa-d788-4da1-a921-02ab986defb8", "value": "3072:SuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+zG:S0czbty9uiaJlyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404020, "uuid": "065b157a-2ee8-4a90-947b-cd61c50e7353", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404020, "uuid": "9857ccc3-7e4e-4d38-99b1-657c3791bcce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404020, "uuid": "14b17a26-51e2-4d66-b25f-51b924b24b0b", "value": "23f33612_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed1d475-aecf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620349284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349284, "uuid": "edf24d39-bfc3-4d33-ac09-2c3b182fb664", "comment": "Malware payload (Dridex)", "value": "033f9700a65e055d91f88961b54bfa3b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349284, "uuid": "3e774d55-8904-4941-a57a-4f7b5ce3a5fe", "comment": "Malware payload (Dridex)", "value": "4e1f4e9eacd6b85c8fc173ffc4c6800329a4199b16d14435bc81f0b5183e50f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349284, "uuid": "76650920-1b56-40d8-bef7-0de0c5231a1a", "comment": "Malware payload (Dridex)", "value": "b0b5db985948964bd4ea9a0cc514c770f2ba07fa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349284, "uuid": "8769658e-a585-4e22-9aec-c7284fed2906", "comment": "Malware payload (Dridex)", "value": "a9bbfa8cf3c074e68c3b7c582fb6fb63722ef0541659c7c4b37d75c24827521e8e667b33c354b1328fa26aefbca83922", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349284, "uuid": "3ffdb0fd-0694-479e-a578-ce4dc4109045", "value": "67F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349284, "uuid": "30b9d010-13db-436d-a2d0-536f2c313f87", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349284, "uuid": "e4e8065a-ef2d-41aa-b83d-308029f77245", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620349284, "uuid": "0a9f4572-d694-4e98-92bf-e51a128cb4fa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620349284, "uuid": "25430417-3cf1-44fa-9876-03aa322f2d8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349284, "uuid": "89474c6d-4bd1-4b93-82dd-5603e3437bd0", "value": "033f9700_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4990ad-aef1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620363673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363673, "uuid": "118f7ec0-c0a4-458d-8090-3a33da1ff673", "comment": "Malware payload (Dridex)", "value": "e60c9a5276b5a8252693bd0201642ddd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363673, "uuid": "678229e9-0473-45b9-8b9d-81796bf20713", "comment": "Malware payload (Dridex)", "value": "4e35bef3aedfa9663fff3f45fc765337e314491bd55f2fd31ae24568c474859c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363673, "uuid": "2d821790-850a-4b8a-90fa-dfd0b77d6ec8", "comment": "Malware payload (Dridex)", "value": "fc8bc11681e6cb5971b0748bac1c01c90f0a5a59", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363673, "uuid": "1cd0c484-1922-4cb3-a0aa-4b3311c73ed0", "comment": "Malware payload (Dridex)", "value": "5b5acb05efe675cee39eded031001725de18e4a02214f8c244b31feca9b498b40f17791c776d2b25fa5bbf4b9962b22d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363673, "uuid": "10a924b1-c45f-4e61-a165-0e49cd4427bb", "value": "C4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363673, "uuid": "eff232d8-580a-4e2e-8c6b-a0f2deb5f632", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363673, "uuid": "9f2970de-4ba3-439f-a823-ad341fc72b39", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620363673, "uuid": "54fb31fc-878c-46a7-8650-9d35f4316eb0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620363673, "uuid": "696319b1-785e-45d5-aa3b-5c6c2d7d4879", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363673, "uuid": "c126f490-befb-470d-bc84-c1ef12b7a626", "value": "e60c9a52_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d21910b-aec7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620345711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345711, "uuid": "6c666e3c-aefd-478e-bdd1-216bcf7610c2", "comment": "Malware payload (Loki)", "value": "921a3bc551ff4a94b6cf3f4a6c82d2fd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345711, "uuid": "1b66a2ec-51ba-405c-ad5c-e79c69aab97d", "comment": "Malware payload (Loki)", "value": "4e4b336ed42d4913d9c91776466e0b19ca319221cc723d4dc21baff83eba497a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345711, "uuid": "d00e0949-d1ff-4972-b46d-0d1c96381cf6", "comment": "Malware payload (Loki)", "value": "5bd72e93c92c3424f9e76698d76512fc12c36e34", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345711, "uuid": "e3a68a63-b807-4527-a9a6-865262a1f0bc", "comment": "Malware payload (Loki)", "value": "7305be538cccda2c93184d06f0e5b0ea897b60a04ffb3026b6218f4b270b5af128284a5ca985775c195ad14d16aa69a1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345711, "uuid": "86b177c8-b8a0-4c3a-81fc-6ea9cde29eb5", "value": "F6E4230CFA66FBDDD4307B94AF53B4646ABEA1BC65203ECDDB980551F2A12F5C072160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345711, "uuid": "6be5d679-cb33-4fab-82fd-6b3bb85bee04", "value": "12288:je09AW9oCGaxG9Ah0rJwLEz5GviUL0Cb3qg8GSMR6jB/lQtkNQv:jB9ARC/xG+irC4IJ0c3f8E4fQxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620345711, "uuid": "6d907e79-2160-4180-921c-cba195ee7fa6", "value": 675911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620345711, "uuid": "b7023ade-ac65-46c2-be06-09d53bb02650", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345711, "uuid": "0cf84588-63ad-488c-a6ba-477bc7cafccb", "value": "921a3bc5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5022d6fe-aec7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620345663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345663, "uuid": "e099b567-5dca-4dc6-b3aa-9ca39ad85b9b", "comment": "Malware payload (Dridex)", "value": "232da878bed538b804e9e0e24987057e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345663, "uuid": "84827e33-505b-4f7f-b3e2-a793c947663f", "comment": "Malware payload (Dridex)", "value": "4e642e97ff81c6f82bdaed1b07d7dbe7e7d6465bc351bf9dbdb7f3ec3a26d60c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345663, "uuid": "b4c562ec-be18-44c1-828d-3b28a686dea9", "comment": "Malware payload (Dridex)", "value": "4f6a64be852d49cd4cdba7f935b2e1b0b97e520b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345663, "uuid": "c4b0072c-f9d4-49a3-ab01-4751fe0d1d91", "comment": "Malware payload (Dridex)", "value": "431949b6d199e0216117083ea0689cfd99dbd643ae68f75264ff8662a7b8f10d1ed7d280702beb64e68d8307e19ddc42", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345663, "uuid": "501ac7f0-14ee-4f8f-9c90-42a1bf74631d", "value": "42F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345663, "uuid": "1769ceb5-639e-4a15-9078-783a3a202c20", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345663, "uuid": "08188184-ae1e-4914-8fa6-9890c301bdda", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620345663, "uuid": "689f6d12-f04f-42d9-b1bc-3f579bbf7b44", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620345663, "uuid": "340634c7-ebe1-442f-a0a5-6307e00b154c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345663, "uuid": "de75a45d-8423-4ec6-8ecf-cc4bdc1e86c7", "value": "232da878_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04dfb226-af36-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620393210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393210, "uuid": "fb6cab0a-a539-4ff3-ae7f-9f09cdd63716", "comment": "Malware payload", "value": "c4914e07f473f4d10c84c1fa6c1940e0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393210, "uuid": "8fae9052-4239-4346-8e5a-3e02cdc067b9", "comment": "Malware payload", "value": "4ea5fe965f1ae5edbb98117638456530a4e506e8720dd0b0464f1dc5958889ff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393210, "uuid": "8ddfaced-693d-41c5-8bfe-0c2a239bb3f8", "comment": "Malware payload", "value": "4ffbacbebbfd34153210a92485f550add6e372f3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393210, "uuid": "01244c91-c80f-4d41-9cc0-89ae8486ea4d", "comment": "Malware payload", "value": "836bd90fc7a6e54b64ea5e1cca6eae0e7f77fb71e27e3ea52911a4f146ae27bd142454be1605742552167f40bf0d4845", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393210, "uuid": "adee97f8-0add-498c-a832-313270c36594", "value": "FBD2E1320184487387E145F5EDEA16069234DEA0FCDA64DFC328876E39D6483EB7CE99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393210, "uuid": "7c06bcea-ff13-4f05-8ffd-46673ae4ef21", "value": "768:+XkYVxuelJq7sfdbr0efZ1allvLdJd7v3Umu:+XkFer2AgevEdHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393210, "uuid": "bca0db7d-318a-41b4-bab1-962ce18ef723", "value": 31036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393210, "uuid": "242db565-a657-42df-9ed2-5ef32ad998c2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393210, "uuid": "5fc3f768-3448-42fc-84d7-b237bddfd452", "value": "ARMV5L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f1d966-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403542, "uuid": "ea521afb-c4ed-451b-a2ee-f7f9b6b8a449", "comment": "Malware payload (Dridex)", "value": "ea0318ae00d25507e69cadff46f1dcc7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403542, "uuid": "8196beda-f014-40a2-95cd-28b8d46e97ee", "comment": "Malware payload (Dridex)", "value": "4eac6c2e457d4c9dc4f26f96a3e040568904314d85cdf371aa0cc470d06c222b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403542, "uuid": "8cc52d6d-0465-4513-9d3c-3204be7963f5", "comment": "Malware payload (Dridex)", "value": "32fbedbfc06d68879483934ba3ac90b38679862f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403542, "uuid": "4ea27cca-d9cc-48c1-a7c1-d4c974a309a1", "comment": "Malware payload (Dridex)", "value": "cb9fcf7af384881a2241afc4ff89706a488803f5b5aeae7c6837a6701f2fcc9d84026ac27db5373684196f249edc6ef6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403542, "uuid": "9c616767-f459-4048-ae3f-08bc938645a4", "value": "12F3D081E7CED5E0FC079B333EA80EEF52310087691854E4EF29DABD96BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403542, "uuid": "0030a9f9-5fa0-4b73-a417-e1a755a84784", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403542, "uuid": "32ae1701-bf49-4cc1-99f0-b361cb1b7d32", "value": "3072:qBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHit:auXLcclWEc2HeSjNjGdeCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403542, "uuid": "1c022aaf-46f7-4e9a-91d5-d2305b9e832a", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403542, "uuid": "08507424-17db-4183-b4af-0c4abb22f630", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403542, "uuid": "d3925045-3226-4e23-b344-8e483beaf4c0", "value": "ea0318ae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ff76b1-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403470, "uuid": "0b5ab8b5-be0d-42ae-9596-e30e680be9a1", "comment": "Malware payload (Dridex)", "value": "d8d455b4710febbb4c37873a7e8730e4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403470, "uuid": "32a4c334-8683-48ea-acf3-0310a72ffb53", "comment": "Malware payload (Dridex)", "value": "4f511a1b2f2a3440afb83162ca797091dff2492b41b926e8e6927cb65f1d1797", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403470, "uuid": "044ab849-ec3b-4881-b0d6-3c8eb3703e62", "comment": "Malware payload (Dridex)", "value": "6e024addb7bf0f255c36547fa5e338df15973c74", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403470, "uuid": "54fd4b2a-d102-4eb0-b4bc-93a6977c8f6a", "comment": "Malware payload (Dridex)", "value": "c0b8fcc80f6c2e224f012352023141387515e6f36faafa3bbb6135928f2e1c3adebacd4dc3970cd11604fac15bd1e146", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403470, "uuid": "bb576a9f-4e9c-491f-b94f-0ad54260ccb3", "value": "6FF3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403470, "uuid": "fdad860b-2594-4606-a81a-43994de89b91", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403470, "uuid": "53ab600a-40f9-492f-ab4f-498aa7cf5a6e", "value": "3072:0BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHqE:wuXLcclWEc2HeSjNjGdeKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403470, "uuid": "4a8c9651-0a7b-44c5-a700-6f421f289207", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403470, "uuid": "0a46fc69-118f-4de7-831f-9a77c1d3c6cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403470, "uuid": "7e57a543-5403-4925-a8de-58c685ba9d0b", "value": "d8d455b4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfbf4a94-af47-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620400852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400852, "uuid": "5dfa444d-2ef9-44f2-924b-8809b07c5b11", "comment": "Malware payload (RemcosRAT)", "value": "a9d4da3791d728d32e7b4bfc823744b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400852, "uuid": "952ce509-7b33-4550-b0c3-d204b68432c2", "comment": "Malware payload (RemcosRAT)", "value": "4fa4ab75bd8f5439907cadec8c16b8e006045e73bc45adbbd5ab368b20cf2c5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400852, "uuid": "8ca36e3d-2363-452d-acb6-ff5bd8de18b5", "comment": "Malware payload (RemcosRAT)", "value": "82fda97279a81db1010e3df2ae6cbf69eae1f956", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400852, "uuid": "db65e413-a395-4e3e-ac1f-5c1925da9cce", "comment": "Malware payload (RemcosRAT)", "value": "3ea8818fa3969263730c7ab269d6e9edbed99100e8b963ffeb4b73ac2182c9dc24eb0da77bd20f8137bff0e954d4a272", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400852, "uuid": "45902479-1913-4dfe-b5de-8be8188c04f0", "value": "3CE4AF21F6E11533E15F5B7C5C2BF6755C26FE412AE8118B9BF87E886F7928038291C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400852, "uuid": "69190b93-4a5b-4448-8af2-dc392dd61ec9", "value": "b124d6d7906bfbfc346167632abb74ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400852, "uuid": "19ed43a3-fd19-483d-9eeb-0c95b36e8b23", "value": "12288:7L4F9NDkBISBvY6gjo1gsUM6fZdLya7FC3OeU/Oy/Y:7UF/SS6bqsxKB/FCTUD/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620400852, "uuid": "12ccfaa4-a038-4c4f-a5ad-14f403333605", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620400852, "uuid": "a7ebb3e0-0d7b-4620-a62b-a26beadc82f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400852, "uuid": "f7d285dc-4818-427f-9d25-a89031142c11", "value": "Swift-Correction.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4253d3cf-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404051, "uuid": "3a66fcf5-32e8-4ad7-9f00-85ff2f55b7c0", "comment": "Malware payload (Dridex)", "value": "ab1b26f67e21bd85b4d280005eb14b57", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404051, "uuid": "6af7beef-35c4-4bb5-b159-39f84ac7dc8e", "comment": "Malware payload (Dridex)", "value": "4fd640302e6308e01bafdb9dc6fecc80970c9ada222213ccd89a33e4a467d796", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404051, "uuid": "e0b64726-4ba6-43c9-a1d6-b497e0737a25", "comment": "Malware payload (Dridex)", "value": "25f59ae7d35af085521d1399af32891eec5d99a0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404051, "uuid": "e3b0dba6-24cb-4874-a427-50754470b174", "comment": "Malware payload (Dridex)", "value": "e7195b88aaad66feccda25e7944f00b8284406bd9fd0b4eddfc3a40041a9b6c62cd1fab431ee1d0293784128dcd9084d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404051, "uuid": "933b4ab7-4fdf-4454-bb3f-493481439e4f", "value": "A0F3C141C9C5CCF0CBE36C3A4695963B3228B941995A8E42EC64CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404051, "uuid": "ae525a5c-3557-4564-9de6-f8fafa25a727", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404051, "uuid": "0d82bae2-50fa-4e83-a274-b53db85f5e59", "value": "3072:tuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+5d:t0czbty9uiaJlwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404051, "uuid": "98aa981d-78b2-47d7-86b3-6b2fddefe16e", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404051, "uuid": "5a39d8f3-4d2a-4466-a0bf-3864ed58d8e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404051, "uuid": "981c3e76-04aa-445c-8208-11c65ca0e689", "value": "ab1b26f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "294e5c29-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404009, "uuid": "17bdec65-c20e-4375-bf2b-0b7639fc87d4", "comment": "Malware payload (Dridex)", "value": "145a73720b2de59b0397ecd4a219f209", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404009, "uuid": "ded066f6-0954-471e-984d-07ee4c40a3ef", "comment": "Malware payload (Dridex)", "value": "500d72b8d441796dd73f8afc8ea0f3b27a469239c5749ad839424430e5673ce5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404009, "uuid": "32b30fd7-221a-4ab0-802e-cc897f9b611a", "comment": "Malware payload (Dridex)", "value": "5f359b4b5de768d9409916cf6e5c81e64e125759", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404009, "uuid": "c61141e0-81f3-45bb-a6e0-047a59913822", "comment": "Malware payload (Dridex)", "value": "0aed792b512a81e52740208094b2a082cb1d24d87b3b9af107b7f64ae851ca18a09d43c2da748ee0001646022c44049a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404009, "uuid": "bcb7377e-c956-43af-b943-2c32cf2fd3a9", "value": "4BF3C141C9C5CCF0CBE36C3A4695963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404009, "uuid": "47928e47-b787-43de-8ca5-724f04a06f10", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404009, "uuid": "86f8c37a-f79f-4e34-b241-7682158b5424", "value": "3072:puFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+0Hl:p0czbty9uiaJlhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404009, "uuid": "3e3aa1f0-45a1-48aa-9ff1-9f568b7771d7", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404009, "uuid": "b78ceb7c-c6fd-445e-b8a1-82dbdee68599", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404009, "uuid": "b53b8f45-850a-46a8-88a2-99c6adf5497a", "value": "145a7372_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56cb9090-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407092, "uuid": "b7f78296-9b53-47d7-8382-2fefc1f0beb0", "comment": "Malware payload (Dridex)", "value": "8c212e73a5a2fca7db99163c25e2f3d0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407092, "uuid": "3d3264b3-260b-4e3c-8c83-8570d8ea7d4c", "comment": "Malware payload (Dridex)", "value": "50138efa259fb45b0cc1f05ba105930628f0719d60cabb3324701876e95489b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407092, "uuid": "260485cb-7850-4979-abe5-c699ea0f71a4", "comment": "Malware payload (Dridex)", "value": "aff7237029dbf178285ab3b5693ebf8ac3cee0af", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407092, "uuid": "367e0718-1fa3-49a2-a806-e81da681edf9", "comment": "Malware payload (Dridex)", "value": "350c2115810451c0e1723dfabbe670a66b79d75303550f1714f30c59316bd395ed7edf9a6e39970037d63904f4e53da2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407092, "uuid": "4c271fc1-4896-4594-a0bc-f7c45b52a585", "value": "DCF3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407092, "uuid": "5461a8b4-f4ef-4c2a-8385-3b236dc93914", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407092, "uuid": "9829e9e1-9408-439d-87ca-b753a9249d31", "value": "3072:rBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:NuXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407092, "uuid": "b61c42a0-616c-455b-b8ac-013da0969340", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407092, "uuid": "3a117b28-1ecf-4604-9feb-6eec034d9a0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407092, "uuid": "d54abf3a-24a6-4686-8de6-ce0f249dd5a8", "value": "8c212e73_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2531dff7-af02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620370931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370931, "uuid": "4506cd76-6607-452c-9c27-0acc03d2bda5", "comment": "Malware payload (Dridex)", "value": "869dc38d2acd3df2a6f42207665e4471", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370931, "uuid": "84b5d374-29f0-48ed-b4fe-649799c0bd11", "comment": "Malware payload (Dridex)", "value": "5059a1ef21917639996fdfa7b0bd24ced5d97d5bb0ee80ab85eb4af593da6fed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370931, "uuid": "ad0f2bcf-5562-4bb9-b1a2-fcbc54a99ac7", "comment": "Malware payload (Dridex)", "value": "4d821828507b37198370f3a49b3910227f77e0a8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370931, "uuid": "f54f9964-8638-43b5-ba85-670b9bc39184", "comment": "Malware payload (Dridex)", "value": "5803ba89c9bcb42088e7eb13928a3ae631aa62b390fc0a42f578bbcac12342b2eecc33a22cff0f2701f2589b33ca7fb3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370931, "uuid": "3f577744-bb64-42b4-8d47-3a160c5f36c0", "value": "39F3C088CBB3E4E6EFB2D37976F85E1B460674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370931, "uuid": "8d3410e7-6266-4c25-a47e-6332df976203", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370931, "uuid": "a075069d-e54e-416a-a4af-0c1d241c1cca", "value": "3072:TIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Ec7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620370931, "uuid": "4d4a21f8-b9b9-4bcf-a453-bb49a9890d13", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620370931, "uuid": "c3724788-1710-4309-9a09-27ff7e88b33f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370931, "uuid": "86f13635-bd30-45e6-b280-5bf8941fe9da", "value": "869dc38d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fac6fb3-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403563, "uuid": "267202ae-7ab4-4e32-8174-ddff9f95bd43", "comment": "Malware payload (Dridex)", "value": "82b90ba9c6ce67a17cd339cbaa28bac5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403563, "uuid": "1f38b35d-2f7a-4104-89c1-36f709801920", "comment": "Malware payload (Dridex)", "value": "50773f0de2ebc684158b8fbf97cb53fda5e862f2917f3bfd8bd0e4dceb005657", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403563, "uuid": "345323aa-4882-4a22-8f3e-6c3675ec2ffc", "comment": "Malware payload (Dridex)", "value": "934a0bda9b5ea5e544d2332d5118ed5a92b832c8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403563, "uuid": "6bd3eb5e-d492-4c3c-ad3a-cbed1ff23484", "comment": "Malware payload (Dridex)", "value": "d044373009e4d562bc13b864b0b3ae0ad1bc18bb27255fbbf57954e39d659481cfc5c3f234b504c7a893691364ee289b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403563, "uuid": "9093831d-1881-4cf7-b727-802fddc0ed5c", "value": "F9F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABD95BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403563, "uuid": "6eeec4e1-4c97-448c-b9c3-c9de906df297", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403563, "uuid": "7c7c14cc-ed2a-431f-a98c-3d01f5cbbd7b", "value": "3072:pBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHtZ:3uXLcclWEc2HeSjNjGdeNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403563, "uuid": "00e1f091-9d09-490a-b6e3-fab13ef64683", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403563, "uuid": "219d93b7-3f1a-42af-84a4-8ac7c4696cb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403563, "uuid": "2a3c30e7-7bd3-4ebd-a929-366c745043c5", "value": "82b90ba9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1982cc-af0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620374543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374543, "uuid": "3b80a65a-5798-460b-bed3-0a5bbe361c12", "comment": "Malware payload (Dridex)", "value": "c3d3d95e6de04e3d0b489400aaf30d02", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374543, "uuid": "12f49b8a-7c7e-41d3-9683-a957583238a8", "comment": "Malware payload (Dridex)", "value": "50b1e12bdc077133b0af1eb44a5f88148bf8f120642287cb6267c7e94f28876d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374543, "uuid": "3060af41-839c-47a0-8537-a140015ab3f9", "comment": "Malware payload (Dridex)", "value": "74542a98d8f938d4e266742f9f1547baeeea40a8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374543, "uuid": "c87c8577-804d-4a66-8b10-1612bfb0cccd", "comment": "Malware payload (Dridex)", "value": "3f3eb6a95940c3a4dc11fb6ba45da9da56eb94bcc5de3d7d38698573302bd76c299dad9aec38291cc52dc65da855e7dd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374543, "uuid": "c20e834c-f819-4ef5-9239-08e45de55486", "value": "97F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374543, "uuid": "29cf0a94-c164-427a-85c8-2bf395f81954", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374543, "uuid": "7bb2e307-07f8-41b8-b32f-0c766f39bb76", "value": "3072:siFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:PeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374543, "uuid": "4acf0828-d932-48ea-8f9c-f1725c0b1610", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374543, "uuid": "55268cf3-9d7e-4591-b488-c1e647c13407", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374543, "uuid": "5248524d-157d-4536-aa0f-fdb675f017b9", "value": "c3d3d95e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9b2663-af6f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620417732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417732, "uuid": "6057f5c2-4ccb-463c-b958-9333eeb80a6c", "comment": "Malware payload (Dridex)", "value": "e86aba156daa49378b7dd8b17f6a9084", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417732, "uuid": "8d0ed9ea-30b8-46c1-9c0b-7d59341f3a7a", "comment": "Malware payload (Dridex)", "value": "50e5acdfab127b1338a237d5b7dd722c1fca2fd42411b4bba9f3ccf6e7f28f49", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417732, "uuid": "c99f75c4-41ac-474e-9c85-21e70d2f0b14", "comment": "Malware payload (Dridex)", "value": "4bf07b38d7eb1e0f6586a0a867c883941d4b1f62", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417732, "uuid": "aa3b794e-7be6-4a79-81b3-57b09602d765", "comment": "Malware payload (Dridex)", "value": "edcafb1d240db27177f33dc7a772eaf2dccb725b683710e80cfb0c11aab74c42d7298359d46a8d60ba7acddc74f382ce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417732, "uuid": "c6663d25-bdc4-4045-90c3-079518e7573e", "value": "93F3D088CBB3E4E6EFB3937866F85E1B461174551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417732, "uuid": "8a0abb1c-21c3-4b91-a9c2-8a8d5a10a247", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417732, "uuid": "4f0c6605-8398-41e4-aa04-00b6d3b6bdb2", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620417732, "uuid": "7e983bde-e2d8-4d24-96e2-6703650daac5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620417732, "uuid": "afcb8bc9-a313-4d96-a64a-c2485f15a9aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417732, "uuid": "b140e3e2-caa5-4a59-9744-d5d32c2148c4", "value": "e86aba15_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46ac26f-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403357, "uuid": "35573331-1ba5-4f3e-9599-e365ded97039", "comment": "Malware payload (Dridex)", "value": "f3f8695538033c38f768a0bce56e223d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403357, "uuid": "e4e596dc-14dd-41c7-84b0-4ccfcd2d0d84", "comment": "Malware payload (Dridex)", "value": "50e6aa5b78e21e9202e29f3d33ff1a777e5b5120777c873bd041e585f043f7a3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403357, "uuid": "91bb983b-56e4-487a-a1e9-fd5b53d63abc", "comment": "Malware payload (Dridex)", "value": "d366381d40b304c35cc765bb0f73c2eb60427e3c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403357, "uuid": "f83ef99e-b480-4333-b3de-bf2a4b9a144e", "comment": "Malware payload (Dridex)", "value": "2dfbce767060ca5cdcbabb2948ee9910b339c26110929ff5fa42105e34ad783c97d5c7d89d67edf43df2aded14094d44", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403357, "uuid": "822d948d-fb8e-41d1-aeb5-817ed0d2fb81", "value": "85F3C141C9C5CCE0CBE36C3A4795963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403357, "uuid": "c4d6b59b-9746-4123-b43b-c4e068fb952b", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403357, "uuid": "0cf263a1-cf1b-4a01-a053-1c985efbf19c", "value": "3072:8uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+24:80czbty9uiaJlP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403357, "uuid": "6e718822-2f49-4b63-af6b-8803b78d576b", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403357, "uuid": "305f5726-26d6-44c8-9803-2498b7dd6e23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403357, "uuid": "e5a30051-5d1d-4787-ac96-1540a86a5395", "value": "f3f86955_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ab6d69-af3e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620396842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396842, "uuid": "da2e1c26-a1d5-4e0f-92e6-54e54ce3c325", "comment": "Malware payload", "value": "d33013cb6b28255069fcfea0575f49e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396842, "uuid": "4a1022cd-7c9e-4752-aad7-975fe69f3b8e", "comment": "Malware payload", "value": "5178fb0c885be51a83a0c53f56e86564548e65080913940eac96d9562270c299", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396842, "uuid": "fd7b9904-512a-4e26-826f-9f433a6b7cf9", "comment": "Malware payload", "value": "fd4a4a0ad4e15d2c6a0d9b8bbe7dcde95bada378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396842, "uuid": "636322a7-c24f-47bf-9b46-b63bc788983f", "comment": "Malware payload", "value": "4ae04167edf9a9db162a469da9eedfd3a3bbe382a8798b27d19847860183db027d21f7b43384723c34e5e0e7f126ff56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396842, "uuid": "0cd7b699-d794-4cfc-af60-f22b40685713", "value": "CE0512B700A451B9C4581735F4A61F0F76A8C6390B84B699F40FF2DEDC2E69C4AF93A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396842, "uuid": "60fd586f-c49f-49a2-bdba-6bd7fa1273bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396842, "uuid": "f52af073-93bf-45f1-9794-ea37fabc91d0", "value": "12288:FjY04Ae1MFsLaAIwe3WF/IJ2Y9rxywJckClQ9bKDZsx5zip/AgBWyg8mKzKDNOVF:74AlFzmF/IJcwJcHQXupYgbBKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620396842, "uuid": "fd3c218e-b3ce-468d-9f7f-09b259df6d5e", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620396842, "uuid": "2769d0eb-4a24-4cd9-9a79-ebc3cfd42447", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396842, "uuid": "45bf19f7-d4fd-4c29-b6c6-6c71df14d320", "value": "333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e034fcec-aee8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620360078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360078, "uuid": "e194f84e-4769-4012-afad-9800bd6c44c5", "comment": "Malware payload (AgentTesla)", "value": "5ab9dd1c88be9b296446fa0ec53b6135", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360078, "uuid": "7e5b96ea-8a2a-4f8c-a588-89d8a38c2bb3", "comment": "Malware payload (AgentTesla)", "value": "517e3b49bdab714f883374f56e218cabbefbc3129c675f6cbabfe491fcd4286e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360078, "uuid": "358ceb89-c2c4-4044-b723-af90d2a74348", "comment": "Malware payload (AgentTesla)", "value": "e9d7cf22d80baa54282082442235a06dff860d51", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360078, "uuid": "9aad8412-a869-44b3-b693-9a047251b2d9", "comment": "Malware payload (AgentTesla)", "value": "6b7724160ab7a0e45000bd93522a1d3888c9c833a6769c451e40adbbd40470cef23890168be86fcacf044f0d72d16c72", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360078, "uuid": "d2681dca-17b5-47ca-b807-30379e096019", "value": "90D433CCB7C5E0073692570840785974863929C9DA765A336CDFC9F6ABADBE03813E72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360078, "uuid": "42a0b700-d1be-4533-87a3-32a33da22c40", "value": "12288:Cnd7F/c5PH0ty4wrVnyMz97vCtNrytUp2Bn94YP669/57b:Cnd7Rc5cUrVy497v2NrUUp2bXR7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620360078, "uuid": "13c139cb-99e8-49ff-8a53-f071457d7a64", "value": 620293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620360078, "uuid": "5b9023f0-d248-4fbc-a765-5b78081a52ba", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360078, "uuid": "a943c458-2c0f-4380-8c3f-2c63d93209f6", "value": "5ab9dd1c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef71a5b-aee0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620356505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356505, "uuid": "8855789e-ee40-4ed7-9957-41964f044806", "comment": "Malware payload (Dridex)", "value": "a4ef62753c4faf2b62f70d40944bdfb9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356505, "uuid": "4e59c685-6055-4d38-8a75-ab5706d551c5", "comment": "Malware payload (Dridex)", "value": "51e84e159c779314f1a2c4aca8af86389a49a8c7cd3e20591bbb327c65f9aeac", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356505, "uuid": "4d717768-8c1c-488c-95d8-7146186b7a81", "comment": "Malware payload (Dridex)", "value": "49a0debbc831259c012df63deddbf3758754ff8b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356505, "uuid": "ad9a3975-599f-45c8-a4ab-5af35cf041d0", "comment": "Malware payload (Dridex)", "value": "771a9b4bc2229d7d74dee43076fcb833737acfffb1b891ad77b7c50a89501ec5c51b3b8cd79d94b43624d1b8e2ef60dd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356505, "uuid": "7f9729b8-a1ff-4af1-959f-982c817ed822", "value": "3AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356505, "uuid": "78513470-9f53-4c71-8c4c-292e873f994e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356505, "uuid": "73e0958c-3ea8-474c-9dba-313ce0a80adf", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620356505, "uuid": "216ef09e-40cb-4284-b96d-8c350631bc74", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620356505, "uuid": "e17f4f49-1ec8-40fe-a46d-44782de9c408", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356505, "uuid": "76e445dc-3d41-4013-b7de-1ebdeb77063b", "value": "a4ef6275_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489bc4f5-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407068, "uuid": "47f7845d-a7fc-4de7-8efe-187f54dd6583", "comment": "Malware payload (Dridex)", "value": "33a81a31c984d0c30315d649d6cf6896", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407068, "uuid": "7f579780-a8c1-4e0c-a4b3-0d4150906da2", "comment": "Malware payload (Dridex)", "value": "520e74a2d6b8364de0bededc3f34d1e423a9f7774e2762a7e03da8bbb983bbed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407068, "uuid": "800f3631-326f-4972-83bb-dee75317b6a6", "comment": "Malware payload (Dridex)", "value": "ad3e5b2779797ff66aeffafe1a022634c1228ca6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407068, "uuid": "2ea6f3a5-6053-43bb-9386-1388ffa51c41", "comment": "Malware payload (Dridex)", "value": "c6311540b8b3111a2cbf5b5af4e4fd26f15059ef9aff89cedf1bb80d2189639ccd2b82370ca94c0b0fd7d26b927d9597", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407068, "uuid": "6da8c1d4-0584-467c-be63-03ab0fed4c45", "value": "B7F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407068, "uuid": "1b078d65-2eea-4830-ada8-066a5ace6f42", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407068, "uuid": "94ec3497-1f8a-4665-b8f5-2e0f9ed08240", "value": "3072:zBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:luXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407068, "uuid": "55995787-2680-4ab3-b7bd-f7970cd1d9d9", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407068, "uuid": "7388c920-251b-4d6e-be2a-44e753d89c00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407068, "uuid": "a81a11a1-792f-42c0-b942-2544f15a8d38", "value": "33a81a31_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff15315-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407483, "uuid": "bd0f0cb0-d11d-40c9-bf98-9791f2302cd2", "comment": "Malware payload (Dridex)", "value": "97673cc44bc4ad445ef6da03fca65e7a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407483, "uuid": "e6a21ba8-e0e1-4ce7-a841-82ee3eb23aef", "comment": "Malware payload (Dridex)", "value": "52339b4cd8a9fb3ef2a6c95ff52ce526284f7148d363ae0b9349795ebd126699", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407483, "uuid": "b5610739-ca9c-412b-8a33-875ee2091d73", "comment": "Malware payload (Dridex)", "value": "19fbfb9c5cc9bb565fd8e08297f7bf01cfc17a3a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407483, "uuid": "575f1af8-0c57-41d0-a9ee-b5b90ef06334", "comment": "Malware payload (Dridex)", "value": "b460b6709442eb793881106fc860795df10eaad453ad6f35dc12e6fbcd098f00390e80025d142ab32354db4ac284afe6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407483, "uuid": "921680f6-f136-4e00-a569-d5c4b6ef50b1", "value": "F3F3D141C9C5CCE0CBF36C364795963B3628B941995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407483, "uuid": "0c3952ca-fb53-4f95-a899-54056ee2c779", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407483, "uuid": "5ffb7eef-39e1-404b-a1c0-161f6e5f36b6", "value": "3072:YuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+JU:Y0czbty9uiaJlcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407483, "uuid": "8d17f024-fbdd-43be-af93-7682e50ef594", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407483, "uuid": "e1aa2af7-491e-4fb3-a314-f930fd9a9fc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407483, "uuid": "87a21b16-13ed-4fea-b026-5bb9c169bae3", "value": "97673cc4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad605ec-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403931, "uuid": "51940252-3933-48ab-bd7e-a3440ace3eac", "comment": "Malware payload (Dridex)", "value": "51d60b0ff2e8c8d7daa530e31666af04", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403931, "uuid": "e7e60e20-438e-4c5a-a9c3-d2e4908aa324", "comment": "Malware payload (Dridex)", "value": "524112233dfb50fc687e5ea705abdee8c263998ed05649c3df3f0523168b4de8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403931, "uuid": "a83326d5-628c-4859-9481-9f299c9e22b3", "comment": "Malware payload (Dridex)", "value": "d58d24eed237114589a95306d5d764f9cce0707c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403931, "uuid": "ffa6d4e9-0c8b-4a15-9192-33da6e0b4d2b", "comment": "Malware payload (Dridex)", "value": "8dde0ba326d629d31d685510e61aa2f5218ec0e03574111c5c63a5c53bbd2a768fea5fc9b74b6409f40444630f4a3a13", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403931, "uuid": "96da9da3-8b07-44d6-91ea-1e93364a9a00", "value": "28F3C141C9C5CCF0CBE36C3A4695963B3628B941995A8E42EC24CE3F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403931, "uuid": "dcb62fa0-11ec-4e21-9398-45ea645e3cfc", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403931, "uuid": "099fc436-144c-4dfb-a095-6f71e1adda19", "value": "3072:DuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+3n:D0czbty9uiaJlWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403931, "uuid": "edc22df9-5a61-4cfe-995d-4a5b32b162af", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403931, "uuid": "668ebf5f-27af-4481-9720-0f090bacc5c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403931, "uuid": "0b55a9b6-843d-4eab-80fc-e2b52aac9dc3", "value": "51d60b0f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46127f2e-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403628, "uuid": "98b3a040-cfe3-40f3-8b11-7332edd387d2", "comment": "Malware payload (Dridex)", "value": "24c9a279eb10cfbd0c5dbd1c1bee0795", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403628, "uuid": "7a2c8d8d-164a-48bd-a44b-c55264183410", "comment": "Malware payload (Dridex)", "value": "5249ea02b942e8acca30d5b885341ad693cf0dca609b5d9db76c42b64eb2bb09", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403628, "uuid": "eb5edffc-3dcf-42c8-9de6-46a4ac49f9de", "comment": "Malware payload (Dridex)", "value": "aa7e539d4258c34f561c34f1c75e210e90ecc71a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403628, "uuid": "fe236dcb-0b8d-4192-8e17-b21c262095eb", "comment": "Malware payload (Dridex)", "value": "f6c7c88aa5925774f049844354ac764c88c52f67152dc5ee16d6d0957879be72e421e13416bcab7cd0f8a0b0ee239421", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403628, "uuid": "4d63ef10-f243-4acf-8c61-cb4a80c04ceb", "value": "33F3D141C9C5CCF0CBF36C3A4695963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403628, "uuid": "c8720feb-737a-4d08-aa5a-c581713a2cb4", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403628, "uuid": "eb246847-9f7d-4ac4-893e-428875aec466", "value": "3072:tuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+eE:t0czbty9uiaJlHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403628, "uuid": "ff56d492-2277-4051-8849-8d297b348cc3", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403628, "uuid": "d4b528d2-a322-45da-b3df-1a5644bff09d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403628, "uuid": "6980b240-4231-4b54-b8d4-8c83464e574f", "value": "24c9a279_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe75748-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403825, "uuid": "c5725c20-3cfa-43f4-87c9-b7e9fc3a9c0d", "comment": "Malware payload (Dridex)", "value": "6b80e55541f1c85e3c436717c6b13868", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403825, "uuid": "4a9c0487-bf40-44f9-8d30-c40383f44479", "comment": "Malware payload (Dridex)", "value": "525ae791a460017194ea19303ecb0ec7ce24ce3f24907d08b4eb792930c07008", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403825, "uuid": "5c49906b-0fbd-44aa-b1c2-c0c2fe6c5224", "comment": "Malware payload (Dridex)", "value": "1a5c028e84869fdf77223379695b4da7df36cd98", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403825, "uuid": "66cae044-32e2-4739-ba67-b906a5229abf", "comment": "Malware payload (Dridex)", "value": "e23a930c5147d4178555bb99ffa1e029fda88fadbf2dd486886019d86cc0e5f7205b819663e2929be4e00d8592e4b669", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403825, "uuid": "cdd00d3a-acb3-4d0b-b0d4-80bfdb182914", "value": "F9F3C141C9C5CCF0CBE36C3A4695963B3628B941995A8E42EC24CE3F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403825, "uuid": "c23e8606-2686-4379-9c2f-714be63ed7f0", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403825, "uuid": "9db5b436-6add-416a-97bf-843b7e60be4c", "value": "3072:YuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+3n:Y0czbty9uiaJlWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403825, "uuid": "5bb3af00-55f3-44a4-ba4c-df43375d1bdd", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403825, "uuid": "bed4855a-22ea-4327-b04f-726e32d6822c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403825, "uuid": "2894b3a2-5cf1-4eef-bdbd-50e131989d1f", "value": "6b80e555_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1737058-af3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620395755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620395755, "uuid": "0c4e309f-6441-433b-a690-8de1c637fa7a", "comment": "Malware payload (AgentTesla)", "value": "f6753da8a0326188e87955f1ce346e60", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620395755, "uuid": "8e024eb7-abb2-407e-a280-6e21a98f920b", "comment": "Malware payload (AgentTesla)", "value": "52b732cacb489185a32d537cfab532789b8a8efe3d3b6fb93221bf8617cac915", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620395755, "uuid": "6f78a1d9-03c2-4aa0-a9f0-9d59a4c11a88", "comment": "Malware payload (AgentTesla)", "value": "c8420c40c7c6f01e1ac8dc7130d9ec0d3d90522d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620395755, "uuid": "6d1f3a13-4aef-4982-9958-a2462575766b", "comment": "Malware payload (AgentTesla)", "value": "b991ef94898799d653d99d5d9a427d1854d3d95452dc8bca1709a23b471693f9285e7ac429ae0ea3f84158eb286808ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620395755, "uuid": "faccf945-c01a-4cb8-86d6-fa377d0a9b7d", "value": "DBE412FC23D89E10C5FE6F756AA152150331B8439913E32D69EC15B26E737D08B1A3AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620395755, "uuid": "1376a24b-2283-4fda-a139-b0753e1f492f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620395755, "uuid": "97af2429-b98d-4166-aff7-a3d437d1cea5", "value": "12288:p3o0JDMBB3QSnjOez6PI6r8jFwH+toMhDvAOTwfyUd5Adx4kJmkpn:eMD0NQSjL2PI6r8jFwERtAXfz5AdKaPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620395755, "uuid": "55bed87f-8b5b-4eb0-9e69-551443c00e41", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620395755, "uuid": "5b96df3a-1b4d-4c6e-a770-6e2854abe08c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620395755, "uuid": "49fb5010-07dc-4f44-853b-f94da8a56d4d", "value": "TMXodV9oPtPfpUS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60cdce4a-af36-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620393365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393365, "uuid": "f49ee88a-20d7-4c9f-9225-007f4c716c94", "comment": "Malware payload (Formbook)", "value": "a2cc53c25b8ae51eab431b18699da8fa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393365, "uuid": "592ea7e8-22ea-41d9-8841-2bea3b2fabfc", "comment": "Malware payload (Formbook)", "value": "5313ca84959a3d88973ad5b85acc66e268c3e8874d5d6f21fcd4a4c1a7628496", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393365, "uuid": "08b74ca7-9478-4e1f-acdb-4b87d383dab5", "comment": "Malware payload (Formbook)", "value": "8a422c72ad1b018ad7dcda36f8fa328bd2c6bfbc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393365, "uuid": "acd9f09a-60eb-43a1-9dc9-a48eed1979f5", "comment": "Malware payload (Formbook)", "value": "a17b407bc949fcd402dade68f059075f6f9e431eb40aa4a16919c1c7f9bdf1f92ada184534236b6f0e32a49686d297bc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393365, "uuid": "3b6e7926-cfca-43e3-b451-fcb3a7468496", "value": "7D34129E6BA0D9E3C51102F11BBA9629EBFDC70420DC5B07EF006BDEB8B2487494E552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393365, "uuid": "74010269-1c8b-446d-a247-f3dc18fd7798", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393365, "uuid": "3ce8c45a-ec74-4f04-9554-4ef16a954b06", "value": "6144:L9X0GgeMNfyjfJQdoRJ8wbODtvYw4GmJDm1iLp:l0VeM6+d+8wMtvt4rJDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393365, "uuid": "42695723-a385-43af-be43-61d21a433578", "value": 231356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393365, "uuid": "ce264c57-f517-4bce-8c46-cd1fcf1d6b0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393365, "uuid": "3ae6c70c-59fd-4651-ad05-81dc83b90ad7", "value": "CT14876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7743f8-af09-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620374304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374304, "uuid": "33c054da-00cf-4769-82af-b85f658bbfc1", "comment": "Malware payload (AgentTesla)", "value": "94a5b1e8337e98e89fa838a78a94eb7c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374304, "uuid": "42e9f49e-6a9d-492d-9e72-eb461e4fb561", "comment": "Malware payload (AgentTesla)", "value": "531c58486429d3d89143d6478d0990ed8a04deb5382c6d585f08dbbe49003938", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374304, "uuid": "22fd95b6-1cd8-4232-ae3c-5174fbec19a4", "comment": "Malware payload (AgentTesla)", "value": "1e3b04fc05c52e457c24514d1ba4a3e16be09df8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374304, "uuid": "63d64078-48c8-4b62-8875-1995c562f324", "comment": "Malware payload (AgentTesla)", "value": "f261a234fc7dfa7672e3d222b1ad457720ab695519db0edbf374f6bb596ccefb4569aa22ec3ffd0cbb7d2af329126023", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374304, "uuid": "fb5a59e9-599f-41c2-859b-4d4184b9399b", "value": "6605E0222385CA50E97A5378E06023F017E1BD12F721DE0FEDE53D8E7976ED58299683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374304, "uuid": "5d05dc84-d14d-48dc-b8c2-0a814809bbcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374304, "uuid": "f14f35cc-2e92-4416-b1e7-45874313bb35", "value": "24576:0pTG8+IMz55qE5tQ928qXJL4okBS5WHJYFUc:gGDfO9WUok0EHJYyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374304, "uuid": "fd7b582c-d7f8-485e-8930-ea703d5811de", "value": 820736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374304, "uuid": "b7e66b0b-5472-4884-b395-3975c54d7e0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374304, "uuid": "0ff241b7-81e0-430e-98ee-87fc777c42bb", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbb2a0c-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403906, "uuid": "c7a60c67-3b01-4162-a4f1-438f49db4387", "comment": "Malware payload (Dridex)", "value": "22c6df4a904987177ac98eaa256f988a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403906, "uuid": "c87fcffd-886b-4d93-8c8a-9dd28696788d", "comment": "Malware payload (Dridex)", "value": "533cdf85c9ae63a86becbc84f8edea64a2b56f40b308137b7dbb7014c4d3d840", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403906, "uuid": "e0614882-331c-41be-a61f-7702dae2bcd9", "comment": "Malware payload (Dridex)", "value": "10dced006df58bc1769bfaf6d455005947fb0b79", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403906, "uuid": "75d95c0e-c7bd-4638-9cc0-1fb205eea20a", "comment": "Malware payload (Dridex)", "value": "c448d01c1164f95a86596eec360f5fb39987fec0e782613c89ce95685f3492ce652d5943be62683951dc1ffa412bb49a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403906, "uuid": "5bd70ca0-f7cd-4e18-bc3f-091b15f9a378", "value": "D0F3C141C9C5CCF0CBE36C3A4695963B3628B941995A8E42EC24CE3F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403906, "uuid": "585a7331-c4c0-41de-b098-ae2395fe9ae8", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403906, "uuid": "85bfb5d0-34fa-4447-955b-a83e9529fd83", "value": "3072:vuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+3n:v0czbty9uiaJlWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403906, "uuid": "56643430-53ec-4251-bef8-59157ebeda9d", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403906, "uuid": "57c634c6-ffb6-4839-8da5-12b1c6de82a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403906, "uuid": "e9f8be72-b929-4c5f-9e1f-6ace5e229f54", "value": "22c6df4a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007bb06a-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403941, "uuid": "5396581b-7d80-41aa-8828-355b1ede01b9", "comment": "Malware payload (Dridex)", "value": "ad71836ccc214efe0919a09382a15cc2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403941, "uuid": "e0d026dd-a060-432c-814f-db4b756bda2a", "comment": "Malware payload (Dridex)", "value": "5343f3e0d840605d67dd76518af8b82461eae9fa30ed496b49ec5d6eca507120", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403941, "uuid": "dc19784d-da57-476b-855c-cecaa1f821a1", "comment": "Malware payload (Dridex)", "value": "e3878a2f317d90f854fa83616b615df69696101a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403941, "uuid": "de153a1e-00b7-4424-a62e-1027d4f1e619", "comment": "Malware payload (Dridex)", "value": "a6a559ff5fe95d00afda1ffe5e6481bbc98be0d7d93957c3847407fe4ae49935c149432da302c9b9689ab7d59b24a233", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403941, "uuid": "0b53bda6-34f9-47e7-b6f0-3f5b42bd5e48", "value": "51F3C141C9C5CCF0CBE36C3A4695963B3628B941995A8E42EC24CE3F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403941, "uuid": "ef8de7b4-9f69-4947-947e-2fb28b4d9052", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403941, "uuid": "0eeeb960-8e9d-4cb5-baff-8b24900a8aec", "value": "3072:6uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+3n:60czbty9uiaJlWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403941, "uuid": "8bc1ebb8-3fa0-49b0-8bf3-18398e155cfb", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403941, "uuid": "8b11a26e-6eae-49c2-8594-941eace2f5ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403941, "uuid": "9c998da5-87a5-455d-8686-6b171ee159a0", "value": "ad71836c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8559d775-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403734, "uuid": "fd4ef3e8-fcbd-4d6c-965e-bee73ec0337d", "comment": "Malware payload (Dridex)", "value": "8691584dd72cc2ea1caeee6baff83ea4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403734, "uuid": "241cf55c-4cb2-44c0-8b03-2bee8aa74332", "comment": "Malware payload (Dridex)", "value": "53caf19c21efca013e530f688bcdff9d051723cf9855a943d332dea7c96491a7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403734, "uuid": "46fdefa6-1b76-49a8-b43f-8e09f3476ffc", "comment": "Malware payload (Dridex)", "value": "96e1af8db2d207273d66b8e89f9f92f8bb73bb7f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403734, "uuid": "f279520b-6026-481b-b8ff-543595cdbd10", "comment": "Malware payload (Dridex)", "value": "90779e946c879b8484f596340153c19893176459bb56a742b57928db2e4b3f1c4e9a9eb6a9148cdb2483c302c37410d8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403734, "uuid": "15c7bb25-e69f-4c0f-97aa-a6dacc1aa01a", "value": "CDF3D081E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E051A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403734, "uuid": "c970a58f-be6d-4244-84cf-0d017066fc9c", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403734, "uuid": "78b3d5db-1aa4-4ae6-8000-22f40b25392f", "value": "3072:VBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHji:buXLcclWEc2HeSjNjGdeDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403734, "uuid": "e8226595-a796-4ea2-aea1-96076cdfb821", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403734, "uuid": "da16071c-b8fb-47d8-84af-a820f04b1fd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403734, "uuid": "37c67791-f075-475a-8c89-87f620b1e3de", "value": "8691584d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c585cc92-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407278, "uuid": "b4bafeca-eccb-4810-9230-24f753bd8f72", "comment": "Malware payload (Dridex)", "value": "ae5f88ac5f0bde99de74677761b57516", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407278, "uuid": "077c9561-f780-40db-a753-2c854337170d", "comment": "Malware payload (Dridex)", "value": "53cea35b5465d8da7c5cbd1208e463ec836e7990c55e34c75b9f64e7772e9d9d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407278, "uuid": "45153bf8-faa6-42c0-b677-b1e112c14a46", "comment": "Malware payload (Dridex)", "value": "1a0c6c8b20064c8de519a37a0e91b4961f35c70f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407278, "uuid": "24c29046-4da2-454b-888e-41cf37a4092e", "comment": "Malware payload (Dridex)", "value": "e48d17ec0c6cfc5d3861d79c849c9449b67be0990e76adbf7246084ec42ad1029537c9c24b1ccaa459d05f89324713f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407278, "uuid": "cb2fd26a-6b0d-4c3a-bcde-da5c6c6a4e6b", "value": "A1F3D080E78ED5E0FC075B333E680EEF52310087691954E4EF29DABDD5BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407278, "uuid": "bd9d4ff3-fb85-4c75-a332-6d807f1aa887", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407278, "uuid": "831e6794-8fe3-44a4-8872-a7c4efb396d5", "value": "3072:MBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHj8:4uXLcclWEc2HeSjNjGdeD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407278, "uuid": "47fb5668-c959-48be-ad3d-a2e909b89678", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407278, "uuid": "608e2178-5201-419b-96b7-d285f464d6dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407278, "uuid": "3bba812d-233e-4f4f-8b23-7df01c3fe1f6", "value": "ae5f88ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1986ea8-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403379, "uuid": "f3473fda-7191-4b28-ae4d-8d2bdb9c6a23", "comment": "Malware payload (Dridex)", "value": "1e8e4f8b20d814fc641b46eaf2c9006c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403379, "uuid": "c1ad7dff-7858-4c61-99d2-0aef58c75292", "comment": "Malware payload (Dridex)", "value": "53dcd82dd8d23b610e9baf37d943d560b61156b43863cd8889cb592cec5d56e2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403379, "uuid": "de8bfcb4-7c54-4504-b126-270fd07b6263", "comment": "Malware payload (Dridex)", "value": "85a82cb1d6b82d2726f327f875363897486d7956", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403379, "uuid": "15734649-a3ce-418f-bf2c-e801e82c5a12", "comment": "Malware payload (Dridex)", "value": "6acc646c911b31ab9d4e861210970b8a0733388b96e2bb75709595f9cd3aca2134f0481a05df4756338c8593c5664885", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403379, "uuid": "dca79d11-39b1-45ed-a133-fc3fcdd77bf7", "value": "3AF3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403379, "uuid": "1730f3bf-0ac1-4084-aa00-2ac6d0d2f7cd", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403379, "uuid": "c747653a-e5a1-4428-a22a-e4630d91a606", "value": "3072:QBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjf:kuXLcclWEc2HeSjNjGdeDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403379, "uuid": "40cd3f7f-d161-4417-a5ae-6fd445c0f4e4", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403379, "uuid": "c5907f62-54ca-4f5b-985f-2753a5a1c48f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403379, "uuid": "6df85377-1539-4da6-969f-5d2637151d45", "value": "1e8e4f8b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da76300-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403641, "uuid": "b66d0366-3c89-46d6-a6f8-70cd57121505", "comment": "Malware payload (Dridex)", "value": "fc451a1e269652f714c6fc80ad22081a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403641, "uuid": "133d2e65-c888-4d23-87d6-618fc08317eb", "comment": "Malware payload (Dridex)", "value": "54253a3047d740d0d4fdddd40de339592ab1ffba44dd574b9bfab0a7bc3d9cc5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403641, "uuid": "6a7c312a-aa2c-4168-b3ca-5b329689830d", "comment": "Malware payload (Dridex)", "value": "2f0e1157463f4cec77b47fe0f1eb962a6b2cfb5e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403641, "uuid": "bc1faeb2-047c-4abf-992c-ae6f1f2ae336", "comment": "Malware payload (Dridex)", "value": "ce20854784da0b891b86abb8975d968f9faa99d61bbc9048964b944c736501b59f7efc15b2e679ea32f3ce353d0160c4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403641, "uuid": "d581d70e-ec8c-4327-b426-1b617ff802e7", "value": "D7F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403641, "uuid": "82ca3d79-0008-4c4d-b981-c192f142af34", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403641, "uuid": "6354cac2-abe2-4189-a5e1-ff6c89549693", "value": "3072:ABoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHC/:0uXLcclWEc2HeSjNjGdei/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403641, "uuid": "431a0543-7c19-4fb9-932e-8eab6ad9826e", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403641, "uuid": "b5cc312a-6da3-473e-8138-f97035ff1751", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403641, "uuid": "28c29a35-4f53-4a1c-a85c-87df9b7b4b33", "value": "fc451a1e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d95bdec-aef3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620364449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364449, "uuid": "3bdf7e4b-a344-49dc-8cb3-65f8c7447bf7", "comment": "Malware payload", "value": "11826578d8a8765395c7841fc85f4f40", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364449, "uuid": "7c511556-f840-4118-a7d1-cfd7d471f4e5", "comment": "Malware payload", "value": "5455fb0bb432e22759e24357ad68eac9ed8b531d5aaf2de773851bb4f7959f1c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364449, "uuid": "42a09193-7977-438a-9510-c6719254a8c5", "comment": "Malware payload", "value": "850cedbd31a27167ccb2c26b27f59180548ae6d0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364449, "uuid": "5d4d9acc-3ed5-4c75-82ee-668c74f99cf7", "comment": "Malware payload", "value": "90700ba8692a5cdabe7d56aaade44759fe65b5e280da89cc3680bbd9d5dc2ebf4da3cd9030734190dc389b8f6b8f45a6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364449, "uuid": "cb4cb63e-9c50-4db7-9eba-3022085f4148", "value": "C6A37DCD5920677E949892504C0E214C29AD0EC0D575C9EFCA7D469B4AB27E2F2F33AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364449, "uuid": "bac37f65-af2f-41da-a6fd-f9ab97307400", "value": "1536:8OzyhTHSlayGmXsbn27VVR7JSXzbPsEjoMZp+vbWL1uMRZtl1CeAEzg:YhDm5z2HPsEjNZBZ1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364449, "uuid": "b655e461-6d1d-4f60-99c2-464b0e59e30a", "value": 98322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364449, "uuid": "a0dc1f21-ecc1-449b-b543-775fe45811a0", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364449, "uuid": "70199722-4c96-426d-aaee-6d0b7770a60e", "value": "Consys21.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22427af-aef8-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620366953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620366953, "uuid": "563ab69e-59c7-4216-8955-646afda4de61", "comment": "Malware payload (ArkeiStealer)", "value": "1f16d3bbd1695dbc299d9a473f1356b7", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620366953, "uuid": "c076ecf5-2d4b-4c10-b3d4-b21c7cf8254f", "comment": "Malware payload (ArkeiStealer)", "value": "545614bf6569f8cedfc491801a3d59121521bc0d1ecb3a72d34588598b6d74bb", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620366953, "uuid": "bef58f21-b4b3-4492-acd1-8b9fd410093a", "comment": "Malware payload (ArkeiStealer)", "value": "23e15a37b6968f79d43125f92c6e75b56f1e2123", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620366953, "uuid": "696169ae-acb0-4f29-906e-2216b878bd3c", "comment": "Malware payload (ArkeiStealer)", "value": "231e2372e43d00ec2a8b8cdd6f66cd942f09bd0e3ad46645b48bc1e81c8da044f20fa2f2979b74344d322156cfe0d66a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620366953, "uuid": "d7fb7a1d-f064-419a-b216-95b97e96115c", "value": "97D4E030B6A0C035E5F311F449B692B9792CBDA18B2450CF62D73AEE16347E8AD31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620366953, "uuid": "d9a54041-a21d-4fad-b0c9-e1a5cebe4e15", "value": "3859d82b882d7140b7db7bb274c90a75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620366953, "uuid": "f5f5a1a3-79f9-4845-a827-f581329df153", "value": "12288:EDFjXfPbuzrWhY5aB4ossdo4Q99D3jdTVj4fpMSqeHs5:ERXffYydd7kDzj0fCSqeHs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620366953, "uuid": "bdd7f3f3-3ea6-4776-9693-53cc2dce78be", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620366953, "uuid": "b896553d-f6fe-4a29-a09c-561bc8fa9be6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620366953, "uuid": "cdd7d9cc-500f-43ab-85a8-1c40269f0509", "value": "1f16d3bbd1695dbc299d9a473f1356b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8632192e-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620392568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392568, "uuid": "aac219f6-1bee-428f-8207-8d0d089e8642", "comment": "Malware payload (Dridex)", "value": "2142b056430c1dfa874ad46e0fb5adba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392568, "uuid": "8a015ce7-55e6-4b14-acbb-9410bc6cac05", "comment": "Malware payload (Dridex)", "value": "545ca99f6230a4b3a30c2b27babe35635ab668190c34ec8c40e34a68b73082f6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392568, "uuid": "8ff2118f-efed-426d-8f46-c6dac8a3a28e", "comment": "Malware payload (Dridex)", "value": "9696ec8eb6451edeb26d821361b87a4971eb3e25", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392568, "uuid": "f454f2c6-0820-44e9-bb75-b0584cf52b47", "comment": "Malware payload (Dridex)", "value": "c8a85b0849381d653959a24fab13ac82984f6b569240297c5d60c536d97faf848c3f19b9bf3f6233c3e2b573fd2870fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392568, "uuid": "5a095d5f-5c31-40ad-b4e0-a4f23d88ec94", "value": "02F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392568, "uuid": "c800d9d2-8022-49cf-a4fd-4605df89f90b", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392568, "uuid": "7b6f7c3d-7042-46cc-bfb1-2cfc5bb57d5f", "value": "3072:EiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:HeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392568, "uuid": "023f4138-a588-4bc5-9ab4-d92ccd7f32e4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392568, "uuid": "86a3b841-61b2-4076-8216-9c9dca2ae407", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392568, "uuid": "7f58b3c6-2222-400c-b71f-965a105c14ec", "value": "2142b056_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522b0640-aec7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620345666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345666, "uuid": "4934ac12-2f6b-4a8b-9454-c0364c464f75", "comment": "Malware payload (Dridex)", "value": "a63a3f889ab58676c16cda3db28155e0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345666, "uuid": "3b3b393d-e398-4995-ae34-2a9478adf31a", "comment": "Malware payload (Dridex)", "value": "54b292d74ef8979e62bbae06c221b331041c8a9ffdc3bb2e05b231e89d6c29bb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345666, "uuid": "c9dd6c19-f80b-49ce-a110-ec12b454e23b", "comment": "Malware payload (Dridex)", "value": "d897372ab5fa718ef0d793444a9ea6da50e74b55", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345666, "uuid": "ec86c832-b708-4874-949d-a1388b885406", "comment": "Malware payload (Dridex)", "value": "eab1f8a787786ece02692f072234d2e54adb1e233196628b1919740ae189e1f7ede5052a9a2f5e25b31ed0d47a0cfade", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345666, "uuid": "ff7dd285-710d-49c0-8c54-9d38e066fb1e", "value": "AEF3C085DBABE87FC44A35399471DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345666, "uuid": "06f64b71-0f99-4286-a7b6-853950dd48ef", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345666, "uuid": "093b5553-0fac-4df1-99a4-b9e5ff616eaa", "value": "3072:1e45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:s4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620345666, "uuid": "6cd69500-3b5b-4024-a952-22eaa8a9b865", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620345666, "uuid": "17dc9e1f-5e43-4195-9a2f-69fa8ed6803f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345666, "uuid": "07b17752-15b8-4f0f-91a6-4e28152ba912", "value": "a63a3f88_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e5baa6-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403686, "uuid": "eea7b49d-0b03-494c-a991-8975e2bd1a18", "comment": "Malware payload (Dridex)", "value": "703abce25abc2db7f23dd07b6386c4cc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403686, "uuid": "9826acc8-0afa-4865-938f-22a4018c5b0f", "comment": "Malware payload (Dridex)", "value": "54fede315ff1f5b822425f2dff8ef39bcff34ee39920b9ff07ae64a733da2983", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403686, "uuid": "afed770c-3d15-4ab6-b8e1-36a163f19a44", "comment": "Malware payload (Dridex)", "value": "3f9e9beb1fd257955c76db515826638c6d8326db", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403686, "uuid": "77eac339-7cb3-4fa3-8a92-8fff0e48057b", "comment": "Malware payload (Dridex)", "value": "26010c7d24e13717fa423832ccf834c026d81452b725a3ec957f045eac62b756bcb66be064cab18649e451fcd588e03f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403686, "uuid": "4028f49c-2050-4eb2-bb8c-97be2990f34b", "value": "1EF3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403686, "uuid": "9d50f51d-b448-4ade-bf0c-54d5a92c0a0a", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403686, "uuid": "7dfd6073-920f-414c-9669-3f75a86b5076", "value": "3072:8BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHWh:IuXLcclWEc2HeSjNjGde2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403686, "uuid": "5518f525-98a1-4baf-b800-c0a23ce484d3", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403686, "uuid": "cc87ab9e-7ed6-485c-bbfa-b72383802be7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403686, "uuid": "1436ff0a-1860-40ef-8b98-f00470ad5653", "value": "703abce2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7eb957-af01-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620370839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370839, "uuid": "5ef7621f-6fa3-47c9-a256-0998f197fee5", "comment": "Malware payload (Dridex)", "value": "9bd6831a2b1b88f03badf66a1cc5b78a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370839, "uuid": "dd6c4408-0777-4ad1-8c8b-d59fd5b83a41", "comment": "Malware payload (Dridex)", "value": "55f293814daa7610bb5b14490c82a030ae69649102284fb0c47e1a20cb0c8eb3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370839, "uuid": "b9a608e9-2fe8-418c-af18-4c7acdaccd95", "comment": "Malware payload (Dridex)", "value": "9d0951e64490a4c8a0f62a472bb2512dd1af7b22", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370839, "uuid": "fabb1421-1a15-450c-b1a7-f0e8dc569ff7", "comment": "Malware payload (Dridex)", "value": "476236d4bc5b969e838a81e2cbdabe797890d1ecbd539102012d4eacb1c332c21950f6466f5f5fbda15bab2f597807b9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370839, "uuid": "f37268f9-69a8-49df-92a3-43ea55aa67fb", "value": "76F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370839, "uuid": "f487acf3-5a2f-4e75-86e4-5a83abdd915d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370839, "uuid": "697ccb2c-535b-4e9e-b0dc-3decd511623f", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620370839, "uuid": "5f735792-a050-486e-999a-a3503250f6cb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620370839, "uuid": "c2c1d309-6120-439d-9f19-41c169c18295", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370839, "uuid": "6424d2ce-8a98-4bb6-a635-011953f18dc2", "value": "9bd6831a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4a4990-af3e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620396687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396687, "uuid": "d1d376e7-41ee-4731-bdbf-d49c7b45fa9b", "comment": "Malware payload", "value": "822f122ab8a81e01f02982935ffd3f0f", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396687, "uuid": "57694967-1299-4532-9146-a925b88c6d84", "comment": "Malware payload", "value": "565badd2a33186b73110092ceb5141109197f47e31787309a3aeddc2a8bba5f5", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396687, "uuid": "ca22947a-4fea-489f-9a0e-1ae00dc854e4", "comment": "Malware payload", "value": "0e9f9c2bb41549c49adb624454ea73b8d17f70e3", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396687, "uuid": "81c3d8b3-9815-4fd5-8aeb-cafce94c3329", "comment": "Malware payload", "value": "7965a7323b3a4443557e9372dcbef064dfae2d6dc1d0c7e3d866d7c2d525be6ee1951e086975ed4864035ea0912d1284", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396687, "uuid": "73a9ce96-6027-40d4-8edc-457ccb1a2091", "value": "BB31E6CA61E14A746CA5EA373A7E8850B4D4E5E725CE6F58ACDC3CF9448CE047015B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396687, "uuid": "30bc6a4e-2326-4bbb-9ed2-561cce5eaf1c", "value": "24:vKn5+KnMKn/c4kKnkasKnEKn7sKnt+Kn2EsKncKnKJKnEKnD:vKoKMKU4kKkbKEKwKt+KsKcKKJKEKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620396687, "uuid": "827c3a16-43b9-4e8d-975c-6d177409aa13", "value": 1528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620396687, "uuid": "889ec1cb-21e6-4ca1-a3c9-4278e9eab161", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396687, "uuid": "02db1561-39e6-411f-83f4-0e3e6d08f030", "value": "565badd2a33186b73110092ceb5141109197f47e31787309a3aeddc2a8bba5f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986930fd-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407202, "uuid": "2c1a89a3-7f70-4222-829d-3f8c5ecda2f0", "comment": "Malware payload (Dridex)", "value": "4a73f3fab16bd74491c7b63d8daf7b0d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407202, "uuid": "e2d42fdf-074d-436e-8984-88c60e4dfdd5", "comment": "Malware payload (Dridex)", "value": "56ac086a6cae89d44659c59e9bba9bf96e8db692f53de1f1e159afc60ae463a3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407202, "uuid": "7ad4bc09-27f1-4a17-a148-1337da09b00f", "comment": "Malware payload (Dridex)", "value": "b1e480c21d728154f6070a690e7622fc2bc1c6cd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407202, "uuid": "64a0d3e1-c915-4022-a2d5-c691d7f2dacd", "comment": "Malware payload (Dridex)", "value": "95c6c75e2da8f0347db2cd54635deb5499b902a24bd46b8e88449040fcb647ccbf7e374a59dfe187d4c583fddcf82fad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407202, "uuid": "b27f7eca-c63c-4976-a963-17c37c694e93", "value": "79F3D080E78ED5E0FC075B333E680EEF52310087691954E4EF29DABDD5BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407202, "uuid": "9f1d98e6-ae75-44f7-892d-4802adf6941d", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407202, "uuid": "43114944-db4c-43e8-98ff-a5c516f13753", "value": "3072:IBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHj8:MuXLcclWEc2HeSjNjGdeD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407202, "uuid": "74a6280a-f515-45fa-90d2-6fa228089e65", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407202, "uuid": "d76636a1-47a5-47f7-8f78-911005a77d73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407202, "uuid": "656bcee5-6746-49a2-b360-66c045576f56", "value": "4a73f3fa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c30b8b-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620385318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385318, "uuid": "1deb2ed8-7968-4dfb-bb73-f122cb3a947e", "comment": "Malware payload (Dridex)", "value": "16fba68086cdf102c16afcc99a28f72a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385318, "uuid": "0337bc10-b4a9-4f23-ac33-62890607e3e3", "comment": "Malware payload (Dridex)", "value": "56db8a152a41581b1ec78e15196025e0d0352a8a6e8d98b739c74422f246d722", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385318, "uuid": "a601f919-e009-4471-a26f-618659e2d58a", "comment": "Malware payload (Dridex)", "value": "fa586f9ff5903cba5e1c888d82c4ff8df9705fc6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385318, "uuid": "ee76dbdb-4f85-4e3b-a2f3-9b5aab53da04", "comment": "Malware payload (Dridex)", "value": "9920554a95724c1038797929161df27223b2dcf7b27d9295a5890515b86a1b641dd3e620391a92dc7d2f24a1f1e1297d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385318, "uuid": "fd2fcb94-23fa-40e1-9040-8cf9892271df", "value": "08F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385318, "uuid": "b7f59a4f-b96a-4003-8d7d-6f12e69f6a48", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385318, "uuid": "b1ff9e03-b435-4de2-b982-70993e78df3e", "value": "3072:Jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385318, "uuid": "b79d1968-18cc-4a61-98e9-23a90fb0e008", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385318, "uuid": "a734d06d-0feb-4380-a0a8-b93b01747224", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385318, "uuid": "50481849-f336-4464-a922-855010f63c5b", "value": "16fba680_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83358f2-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403497, "uuid": "4e2223c1-214b-48ec-8afc-514d5978d8e9", "comment": "Malware payload (Dridex)", "value": "b12a022bf18f549204a3204933d56b89", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403497, "uuid": "d2bf061c-b95b-4daa-a6e1-f327cf0b0ab6", "comment": "Malware payload (Dridex)", "value": "56ee9604d2ccef310b846124b897d17b60c3bd0949bb34189e55df1ef50547b4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403497, "uuid": "b7b28669-b177-4296-b886-3753c729a599", "comment": "Malware payload (Dridex)", "value": "d2324f70a8aab5307db3b96b9aa06118b2f9c5ad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403497, "uuid": "2d4894fa-33d6-4723-a62c-640e60e6fff4", "comment": "Malware payload (Dridex)", "value": "6d616adf729a1a1479c4779355a9c2aeddc788d1c16a2d6ffa8bc45c5847b32f1f681258e1c5d0148591ccaceb5f64a4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403497, "uuid": "361be0ae-cf3e-4eab-b52c-b7e70e44cf32", "value": "C9F3D141C9C5CCF0CBF36C3A4695963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403497, "uuid": "aeb50163-2f39-439f-86c8-3b724654320e", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403497, "uuid": "cd5dbfab-1e53-4d48-821f-93029b9529f5", "value": "3072:CuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+eE:C0czbty9uiaJlHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403497, "uuid": "14df6065-a620-453a-8bcc-23cfb94cbc97", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403497, "uuid": "5b0ba584-924d-405e-91ff-9bf0f7e6989d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403497, "uuid": "f951cec8-bd99-45aa-a1d8-049bd9b9a8bb", "value": "b12a022b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d40b49-af01-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620370846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370846, "uuid": "99f2d8c8-a441-491b-9a11-5e4a056b6b4c", "comment": "Malware payload (Dridex)", "value": "51336fb2e439b3cba91138b32675c139", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370846, "uuid": "69f03531-adf4-4280-91fb-8ea59f8bb58a", "comment": "Malware payload (Dridex)", "value": "5713a17a0b65c831ccea9dcb4ce14b7676cbb2d6884ea53a1942563f1ac5bc1f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370846, "uuid": "c7b35090-091e-4555-b624-25342dd52eff", "comment": "Malware payload (Dridex)", "value": "486d2bfdf6b53e8ec08d1332e1e1ce5dcce5ffb1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370846, "uuid": "5e029746-97a3-42e2-ba2b-77cca02850ed", "comment": "Malware payload (Dridex)", "value": "504e07bcb0c5ea703997190b4d7b7699f40aa6fd8ebcb3ee7ebb58112e2f5851d4beee474b5670b15bd25fa4ae8a6a4e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370846, "uuid": "259e26ba-acff-4250-a9d4-953706d023c1", "value": "58F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370846, "uuid": "5158da2e-08ec-4950-8abd-43f627522637", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370846, "uuid": "7a9c57ff-a7fa-4f15-bf36-6e2d4aa569de", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620370846, "uuid": "526f5ce9-bb26-4681-8bfd-6e9c96556a7c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620370846, "uuid": "be294e15-471d-4e53-bd74-a717e563947d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370846, "uuid": "5f52fa1a-4232-49a3-a200-dda25ac585f3", "value": "51336fb2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a413735-aedc-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620354672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620354672, "uuid": "72095d7f-6759-4710-91cb-1950c6680bfb", "comment": "Malware payload (ArkeiStealer)", "value": "959727c05f54b7ccf3cb751ae7d781c8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620354672, "uuid": "eb021575-2c56-4130-bb89-3b9198abd4b8", "comment": "Malware payload (ArkeiStealer)", "value": "575ea0ea6808067f46ee7e5026fd5832997e28a9cef3cc1d6227ec5742ead3ba", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620354672, "uuid": "bcdf2146-a65b-4392-8bae-f73c039eebbc", "comment": "Malware payload (ArkeiStealer)", "value": "f3e8dd16886e12b8e667e6d8a11d59b7a2e169b8", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620354672, "uuid": "57292d71-85e1-426f-bbd5-f4f5fc9f5852", "comment": "Malware payload (ArkeiStealer)", "value": "995da6956bbb7802ef605082e5077f51c1f0db4a236baddae295e8b8ac3c8fef7dbd40a9a7b690d6ad14e1a0bd8b3da3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620354672, "uuid": "5939c250-c827-4870-aad0-3e5427ddd1e4", "value": "17D4E030B690CC39E4F715F455B983B8662C7DE15B2492CBA2C53BEA1A346E4AC33747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620354672, "uuid": "74963ce8-3ca0-4821-ba7c-852ceea2c5ef", "value": "ca69c6b93092b0d48acb97177d0397e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620354672, "uuid": "a9c1a708-4b88-4638-8e8a-da23fc959ae3", "value": "12288:nqLAU0f1pgawTmyJvp7p6BgWKfR6v1Idj6LiWaaWvNdFP/:nqL0fdMNuRKZ9dWLnVK93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620354672, "uuid": "b42898e6-0772-4671-ab50-1bcd8a39d4ce", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620354672, "uuid": "4768a2a3-2f03-4914-87c2-fc681785eca7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620354672, "uuid": "58f51a01-3f11-4963-830d-9e77da00955e", "value": "959727c05f54b7ccf3cb751ae7d781c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea4fb52-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407427, "uuid": "1e9eeb49-f23b-4a09-ada3-a2f3925ee8b3", "comment": "Malware payload (Dridex)", "value": "1c582331289e5e1690ae9807ffef9177", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407427, "uuid": "c4104429-9a00-42f7-9cc3-4bc1a422d1f7", "comment": "Malware payload (Dridex)", "value": "5761aaa4bd12893d57c92435f42285a463411d1d96d2c6afc73ccbc8a8225e0e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407427, "uuid": "a9929284-1b82-4af5-9776-5712d9224aa2", "comment": "Malware payload (Dridex)", "value": "d860f438fe4c7f1d40cad99621591434e1a9c20a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407427, "uuid": "24dbe75c-5a9f-4ebd-8b92-210523a18a64", "comment": "Malware payload (Dridex)", "value": "1d52f5fd11556d29e08bf34ab4a6bd28dccd9b3539a622a4105d15a64a72e215db4bb5e78b6f1bb0481f10ac8372da70", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407427, "uuid": "69d2669e-0a06-4fee-b8cc-7c6a463d14ab", "value": "1CF3D141C9C5CCF0CBF36C3A4695963B3228B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407427, "uuid": "9fd7eab8-18a5-4fc1-82da-385130c6160b", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407427, "uuid": "4e74efc1-7c03-496a-9595-aec4afb32586", "value": "3072:KuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+3l:K0czbty9uiaJlCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407427, "uuid": "51b32ba8-1dd8-4142-9525-6d4f6b89a814", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407427, "uuid": "b5efaa19-5553-471d-9d47-56b21cd8a273", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407427, "uuid": "2190b4fa-d8d9-470c-b523-b91e1d31993b", "value": "1c582331_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e462b3a-af39-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620394595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394595, "uuid": "960fc4d8-2f20-4891-8470-16f18f395e81", "comment": "Malware payload (Mirai)", "value": "80ae5d72744d826fff03f58a504dd8fc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394595, "uuid": "9ddc60d8-742b-4780-91b1-4dcafe07c487", "comment": "Malware payload (Mirai)", "value": "5840f0fbde42f00d148562d16d04eb0cca4f26e464c5cd126cc5ecf95f215050", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394595, "uuid": "c84e3888-fd65-4dff-bedd-fda336a5d8b3", "comment": "Malware payload (Mirai)", "value": "5e0e0f721b0bb8699b99070f2006dc9ccd87d4c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394595, "uuid": "e29eedc3-3946-49b9-9132-74708943ef6a", "comment": "Malware payload (Mirai)", "value": "1fe1c857d3da3200bfe6c55a4ecea862dd4fe7b39188f27f07177e6bc62a735d774b64e886934fbc46722138c975b1a6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394595, "uuid": "4257456c-48d5-4d6d-bb26-ec24275eaaad", "value": "9F736BC1BA43D4F1DC01267235A7EF324677E53A2055FB8AF39C9B72AC42611E90729E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394595, "uuid": "81114410-9bc0-4fa9-9be8-3aacf20d13a5", "value": "1536:Bovfv2gwFYl3fnUKyzCc9hKAl4/gB1z2eGW6:+vX2gwF+/Ukc9hKgFBJ2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620394595, "uuid": "3b9e4348-a506-46f3-8b21-f2613be15595", "value": 79280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620394595, "uuid": "3d037481-7ab9-4d7e-a0d8-24fb306cf586", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394595, "uuid": "11a80d94-4136-4a9f-94e1-42fd1711b089", "value": "bo(1).x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1ef244-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407133, "uuid": "f47d433d-c493-4354-a55e-b6d2e4b83b22", "comment": "Malware payload (Dridex)", "value": "bcaa2f09845784eca4e03e1fde1543e6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407133, "uuid": "05090c12-5e32-48f8-8862-d242cc912dae", "comment": "Malware payload (Dridex)", "value": "584a07f76a3fd5742d560a51b5b0f21f19093772e4a947abbe9073786414d28c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407133, "uuid": "c3366e7f-8608-4d8e-889a-6b12a37504ad", "comment": "Malware payload (Dridex)", "value": "6a167ed9bc3fbec5a9502b179f8d4cf06bcc66fc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407133, "uuid": "d8d13b74-7c61-49e3-8519-a51d29144456", "comment": "Malware payload (Dridex)", "value": "7f3536f442a3f6a79a4abac8491bf2d49fc2c2d73ba91293cbd8a18ad9349af31d0ee72d044a3879571e297d0f04cdf8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407133, "uuid": "60abf6e9-26a7-4984-b517-847180939437", "value": "81F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407133, "uuid": "d2cc528a-a960-4dab-9459-586935704100", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407133, "uuid": "5021e9f8-9a82-4db2-afbe-ae9090f776f9", "value": "3072:DBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:VuXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407133, "uuid": "48b3cbba-2728-46ab-82aa-e6b899d254db", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407133, "uuid": "e2151a6c-6f1e-4661-912c-a2b30e40f0e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407133, "uuid": "5c161bb7-2408-4740-9a4e-62104fad6b4e", "value": "bcaa2f09_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f9ff81-aeef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620363101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363101, "uuid": "f9755a0b-a833-46ae-b27a-704ff70fdb5c", "comment": "Malware payload", "value": "ae5b01b53c318c2fa988430dfddf0400", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363101, "uuid": "53cab557-2a3d-4c0d-a408-aeb24717950d", "comment": "Malware payload", "value": "5880734f092220f1502fba1ec1ba45572e8b84715cba0dbf9cc947ba9e7d2670", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363101, "uuid": "73383a1a-4975-475c-ae42-a87c2f28d8b2", "comment": "Malware payload", "value": "bb5ecce074db77549f94f5ee474d3e1b9d49d755", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363101, "uuid": "b3743141-a567-4c5e-ae31-b918dc325a00", "comment": "Malware payload", "value": "bfd7fd9b6726653fbc97b9329109a0fc71821875de07d1078e0688cac6329bb07f0116dfdb4ccf60d13260010b14ff62", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363101, "uuid": "b932f6cc-16b4-4d32-bad1-7f2015cc9b04", "value": "59B27C1163A8D773C8BD2A768D7311554BF2EB089861DF5EAEC5A1CD88E3B240300F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363101, "uuid": "a1f97042-2b3e-4aa8-a9a9-22fea00b0a53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363101, "uuid": "e5a283a1-9533-40d8-a6f7-32392472ddf9", "value": "384:4jcCjcAaQ4GeuVQiXXddhUykdLToE6Y7vcR60tSIUiJskvwKwq6uKJhTqFSJhTq7:IcecAaQ4GeupnupBz6L6sUiJAJLJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620363101, "uuid": "50affdc2-ef12-4df8-8710-22c412d8fe6f", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620363101, "uuid": "1425aa94-7496-48d9-9f8d-7fa3529cd694", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363101, "uuid": "4b325267-34ed-469d-acd7-efedeb0b8e8c", "value": "NetworkBrowser.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b9cf55-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403862, "uuid": "4b1444e4-9f87-43aa-b00b-7b40f507b0ad", "comment": "Malware payload (Dridex)", "value": "f4a5db61693ef1099c9246a00c7a125b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403862, "uuid": "84012875-2699-4c49-87a6-5386aea033e3", "comment": "Malware payload (Dridex)", "value": "58915ed35b77057c8190bd35e1ab441c769603b5ff96855fc4f97507c96d7786", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403862, "uuid": "8d87e3bf-a9ad-4d0e-9f87-81783e702eb5", "comment": "Malware payload (Dridex)", "value": "40f61ea006d8beba4066ad54d9f7da2514993b20", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403862, "uuid": "14e1933f-fe68-4728-b1e6-1d1121d9a106", "comment": "Malware payload (Dridex)", "value": "2f910e133f5b0f24271d711670351e86da94afebd374cc8f5d1eb396014b6284377c94067310b31a7aef3b090119ffe3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403862, "uuid": "b01eb074-08f9-461a-b5c8-6f5f2449ae9f", "value": "07F3D081E7CED5E0FC075B333EA80EEF52310087691854E4EF29DABD96BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403862, "uuid": "d976d45b-3a49-4706-a37f-ab749a31dc51", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403862, "uuid": "56d442a1-1519-45b4-8900-6532ac11a9a2", "value": "3072:SBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eH2+:yuXLcclWEc2HeSjNjGdeW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403862, "uuid": "8aff7129-fa7c-4ea6-a25b-ed71da23eeac", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403862, "uuid": "8abf4949-31b8-4c81-9f0c-562c55085c6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403862, "uuid": "a442f25f-d296-49c1-a4ce-ecd219e83e80", "value": "f4a5db61_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4549e1f7-af1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620381722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381722, "uuid": "a6365257-7c3c-4ea4-b0b1-d2c3d4c2b422", "comment": "Malware payload (Dridex)", "value": "378a4e655d133c7936d8aa6008914368", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381722, "uuid": "f4372ca3-0ebd-4e3e-a862-d9630f66a874", "comment": "Malware payload (Dridex)", "value": "58d2e8e220c75ba87eb8f033b65c5be581a396ac8539d9eff5f7b023f62a14fc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381722, "uuid": "76f35e40-13c5-48eb-a4ed-bc7c7beabedd", "comment": "Malware payload (Dridex)", "value": "94fa946a25aab47ba13f8d40e92ae612ec1ff6a2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381722, "uuid": "a8b100f1-9a4d-4c1d-889b-fa728134f835", "comment": "Malware payload (Dridex)", "value": "fe994916bdd4ad7adcf0c267d912f3e251d44b5047c54e7f9f8b73b6a3c588ad35300c703ae8bbc67be595e65f2d9063", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381722, "uuid": "c7471000-a63b-4443-8696-5ab915f2c592", "value": "FFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381722, "uuid": "49234db2-1e1f-4bd3-b1cd-9df12c66babb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381722, "uuid": "e8663eb4-c0d0-4b51-99ab-12e8c30cae75", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381722, "uuid": "af4ed3a0-7d8d-42ef-90d3-0d1581d65939", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381722, "uuid": "7ba44c15-5380-46e3-a996-f3e8e04403de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381722, "uuid": "6f7db87e-c85a-42c4-ba9c-950bcad056a6", "value": "378a4e65_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9670ef4-af7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620424893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424893, "uuid": "a04caa95-5d23-42dc-a4fc-eb8f369c4eeb", "comment": "Malware payload (Dridex)", "value": "4922d87977934f72fbb09a23386e0fe6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424893, "uuid": "c3a31bb1-e498-4132-928b-d6d078d06bb2", "comment": "Malware payload (Dridex)", "value": "591fd39ab1ab51df25fde466877bb63e18ba39aa219c8e24d8a9ec8551eedce4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424893, "uuid": "6a928ade-7495-43b5-ba2a-9f75326c057c", "comment": "Malware payload (Dridex)", "value": "f3e96759618bd97c7e8ef61d95e054571e3e6305", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424893, "uuid": "127755b5-3695-4337-8f44-d1bef568c70a", "comment": "Malware payload (Dridex)", "value": "2d27a8c7aabc530bb8a48c87eb016bfd0ec59bc034f84a62aa1ccc9f586da3a59111099876cd68c9c8422fbf3cebf59a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424893, "uuid": "1ca45b0f-afa4-4972-80e1-03f1cf4ba552", "value": "86F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424893, "uuid": "0fa02a1f-04f8-4a62-81a0-47a560eeb31f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424893, "uuid": "eb3c1b15-4b55-4834-8b98-d0fdd2274f07", "value": "3072:plpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:plo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620424893, "uuid": "563c717e-c674-4257-8058-9268d52cbb88", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620424893, "uuid": "9ebf550f-8bd3-4258-b37d-d04dea291e21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424893, "uuid": "3f956ae3-3f47-4103-8916-7149af0b8137", "value": "4922d879_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55600e36-aef4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620364999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364999, "uuid": "ca7a066b-157a-4cbc-a176-c48a83775f1c", "comment": "Malware payload (AgentTesla)", "value": "86d2c7008eb5dad31b77ed619b2c7e7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364999, "uuid": "18213fda-5189-4cae-ae70-227a0975dd6f", "comment": "Malware payload (AgentTesla)", "value": "592f466fc7eed27d377915a732e30c9582cdc6d456bf58d87a1161fbbc494c7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364999, "uuid": "097e4f1e-eda0-4f76-b51a-af358a1576b0", "comment": "Malware payload (AgentTesla)", "value": "824edf6042be1d89e1888dfda71af2cce2189a65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364999, "uuid": "314b6a20-e3ea-4140-83fa-8f5d245c2d77", "comment": "Malware payload (AgentTesla)", "value": "8d3eeaea684e505ce38947b6dd0f915c796b10dd2b0ff306545c6e551ce7ab92d045a55843c59ceed74c59d5d6093b84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364999, "uuid": "89ca2870-99f0-4466-8fcc-3899961ad0fa", "value": "EED423AFE6FB9D6F0D5529829770906050ADC71C622C990BCD7A9D1D1D38BA883CD1CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364999, "uuid": "c17f0e6d-3555-487e-bb44-023204ca7ac9", "value": "12288:daAQ3DXBt+Mei4lEOJJEXLQ6AqIphHCrQlYAF4Hbkz29dEKciIrnkA:daZrIBlEIHVpBCr0YA659d1cmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364999, "uuid": "e2c9b5ef-76cb-4006-87b8-e8c2a86cab60", "value": 628002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364999, "uuid": "cb3c7a7f-dd41-474a-b30c-7b436f2a4095", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364999, "uuid": "4434d64d-9485-41a6-a29e-fc64bc46f42a", "value": "PRICE LIST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9281f457-af3f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620397314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397314, "uuid": "cd730ffc-de2a-4cd5-ac0f-0a4679b6a632", "comment": "Malware payload (Mirai)", "value": "d05859af6d854dd97a4a93a0cecfcc2d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397314, "uuid": "42faaaad-f216-4c13-87d2-3072d3e4b617", "comment": "Malware payload (Mirai)", "value": "592fbfe80ab8821780248769c70ead2737944e8bfb5b2a2925a2d305b5ea40db", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397314, "uuid": "919de7b6-1479-4a38-9eac-831965c2cccd", "comment": "Malware payload (Mirai)", "value": "dfea7d465ed336149c1736a0197b5258368db6e9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397314, "uuid": "46aa1459-f2c7-4001-99e8-1484614cf6a0", "comment": "Malware payload (Mirai)", "value": "0bb686c0bce33fe11a26e61af9db518770bc1657edaa4ae7e9550ad6aa1bddbc1786a49ad75700c8f62346f45516c191", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620397314, "uuid": "204ab28b-ddb0-4341-a4ee-a186b3ae6fc0", "value": "1F338DA6C5BDEDA8C1544AB87D258F389B73E00086933EFAD644C65A8047EECF1593F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620397314, "uuid": "1e76f9da-32b0-447d-8360-3c7dadd98f38", "value": "1536:5aR5ewtQZut8GdcPs3q/aKlMLEm0DOFCn:5k5eDM2P+qiK60CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620397314, "uuid": "2787d149-6815-4523-ba28-d8b49a52e82e", "value": 51336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620397314, "uuid": "ceea3c9d-de9c-4040-9c4d-0c55c950c455", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620397314, "uuid": "4756fe10-5d8c-4931-acd3-2aa97456cf10", "value": "Josho.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a231a64-af77-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620421325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421325, "uuid": "6997f30a-0b93-4d3e-b452-fb5a4411cbae", "comment": "Malware payload (Dridex)", "value": "cb54ef9bdbb10f742ed08f0d48681302", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421325, "uuid": "1db0f911-d6f7-4d28-ae29-2b62f647233b", "comment": "Malware payload (Dridex)", "value": "593a556efc5fb035c68d6fee4715b3fbcc9b0dd7f69a2fdafeadec9df9fb0c4e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421325, "uuid": "157ce254-15f9-40c8-9d83-e02869a0163d", "comment": "Malware payload (Dridex)", "value": "e136298cdd5db16fa88e9ca6fe3986839ab5e5e7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421325, "uuid": "ddc82f43-25d0-46ad-a4a1-2b7562a8d515", "comment": "Malware payload (Dridex)", "value": "f6c06cd05e8cbc0409557507a7cbedc6b01797db016ee07030947d7bf8c1b29a19f0bdea094806a3cbf4806447ee8dfa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421325, "uuid": "27c841ba-da94-415c-a649-90563f6825c7", "value": "B3F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421325, "uuid": "9aed5be6-7ae7-4f38-b81d-c8808eef9ece", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421325, "uuid": "5eb3245b-2a18-4dd8-a5ea-42cb689b07f8", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620421325, "uuid": "5b4a18e8-5673-49f2-bd2d-908a8521ccf6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620421325, "uuid": "2bb25a90-6e77-4e25-968b-c0dbf92dec24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421325, "uuid": "7acb7ddd-0e1c-4947-9438-c937cebeb763", "value": "cb54ef9b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b9701c-af5e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620410492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410492, "uuid": "4d88010f-eb4b-4bd3-8076-c332a594c4c4", "comment": "Malware payload (Dridex)", "value": "62a23438d98f337d5efee54466e5503e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410492, "uuid": "8cad3ce3-1dd7-4444-aeaf-fd4d5e07b5d2", "comment": "Malware payload (Dridex)", "value": "594e36e7f097c4fc62b69bec4693ef74cbb2fac99d07df3b8d58a9029616ac53", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410492, "uuid": "0fa4c77f-5ef4-4759-9925-334a210aaf87", "comment": "Malware payload (Dridex)", "value": "0ab2867af11fde832a86e8f9cd1bf4cfcc5a2e3b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410492, "uuid": "a2ccf37f-d550-4ae3-a87c-abfc35abf21d", "comment": "Malware payload (Dridex)", "value": "2b70fb697687a069f62841a8bd597c4222e0f6d94f5c59d2091c0bdc442f821308952d2f6b55f7fa84b8093770083dc2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410492, "uuid": "9f22bc41-3a29-4ad4-9f04-78833ad1cc11", "value": "AEF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410492, "uuid": "c7b6e12c-cd40-4e1f-b7b0-138e41a48b03", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410492, "uuid": "f85a48ca-cc64-4a2f-b76b-89f01b7d7df8", "value": "3072:ylpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ylo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620410492, "uuid": "1dbcf809-63e7-441b-857a-ff325a00350d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620410492, "uuid": "c0f5154d-7878-45bb-8fa4-aa732bc81d79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410492, "uuid": "be160b2b-fbd0-4b90-b278-314cfbaade28", "value": "62a23438_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4090ae-af35-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392985, "uuid": "96f7c2bb-8a6a-40a9-9b67-3e7a1b1bfbac", "comment": "Malware payload", "value": "de32712ab46e29aa3a0adb05539076f7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392985, "uuid": "503ecadc-454e-4052-b287-4016c44a20a6", "comment": "Malware payload", "value": "59d322c8e85b815019d8ebc79f4b30c937dc5f67ec4939d9e8e901152ce7cbaf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392985, "uuid": "ec684d03-1219-47e0-a3e2-7294669a120c", "comment": "Malware payload", "value": "18533c8bf1ccfa614ca95fae824a640148b91b0f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392985, "uuid": "e0ebe99e-f9fe-4268-9c37-e469dbf465f3", "comment": "Malware payload", "value": "652936fc88ab87f082ed399a651451884c082dba48040b72df0f83ea1fc9435e88b51d2c9f5ca38cfeb7466b0671f479", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392985, "uuid": "98ec4705-fd94-472f-89c1-e20653779691", "value": "A453F785F88785F6C91B4930A0B7F23FC730E97D41748A6DDF8AAF35D6279015223289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392985, "uuid": "79897b20-1b6f-4fc9-98d2-cff6ed6658d2", "value": "1536:jQDKSIoxIww4uFjKKq9EuSOg+deCO3u4eT:jczoww4UWKLIhsuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392985, "uuid": "da5f89c3-918a-4401-8621-334a13b4cef3", "value": 63664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392985, "uuid": "746150aa-5955-490d-baac-945f8ed4c2d1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392985, "uuid": "881c7f33-112e-42c0-b226-2074106a92ff", "value": "94VG.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8d0575-aecb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620347532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620347532, "uuid": "62c3e3b0-8a66-43d5-936c-ef598d5caa94", "comment": "Malware payload (IcedID)", "value": "42a5df056229df5e2bf1fec2e475e4c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620347532, "uuid": "3311b132-0388-445c-bdb3-948450003202", "comment": "Malware payload (IcedID)", "value": "59d6971fe43589ffa87a240ea385e546b6330af33b3cdd49750c1b3addc6bd65", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620347532, "uuid": "4e6ae0a7-e059-46cb-82c8-41eba751a9cc", "comment": "Malware payload (IcedID)", "value": "7a5b1254bddb42186b765a936a05d7084607e7d7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620347532, "uuid": "bd95441b-cb76-4933-9b24-25c60a488a68", "comment": "Malware payload (IcedID)", "value": "363ec9b0c63c82d7f71f31ec053d823ca5e84a8d54fece36afc44090fcc2a74ca7b1b981e40f6cbdc9880e8a5a03e9c2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620347532, "uuid": "ea4e60ab-8bd1-42cd-86ad-d368d1451ba4", "value": "55139E69F9EE52F5F44A89B4F08DD31A661DB222405E1A7FD0258FF3CD56223230D25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620347532, "uuid": "2757dc5a-0449-4ec1-8685-da56d9014f0f", "value": "78ed290a779aa51d4473678936319a48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620347532, "uuid": "8bcde8c5-1f42-4ee3-9e04-50d437a752fb", "value": "768:St5V8AoQM45rBwp4U3Ffi7FtdnRFm4O5mgjNdPz1w12ma2q8:Wz8AdrnUN4tzO5mgjNdL1w1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620347532, "uuid": "9a727be2-cdd7-4ebe-90a7-04e1000f0161", "value": 44681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620347532, "uuid": "9d53941b-71f0-42e0-807d-ce80e05e0a6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620347532, "uuid": "411efc2a-c9a1-4628-97e1-15409efa5028", "value": "42a5df056229df5e2bf1fec2e475e4c8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83dd3721-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620385263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385263, "uuid": "4724ddf2-e49e-48a2-b5fc-c9d089083d62", "comment": "Malware payload (Dridex)", "value": "2b2e528816dcadc59bfd9181d22ab6a7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385263, "uuid": "61f1649c-bff5-40fd-b752-bdeb63db1451", "comment": "Malware payload (Dridex)", "value": "59d8e5a4b1a5f505cfd82a0b5a4e32936ee6410346e3d03f5581a924d3a1295e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385263, "uuid": "c8b1d9ef-f972-4eac-a1ba-575bdaf53475", "comment": "Malware payload (Dridex)", "value": "4f2d9f5b937c8df219d5477127be2dd0a6140c27", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385263, "uuid": "a38af33c-8b13-41c5-ae10-2d581dff953a", "comment": "Malware payload (Dridex)", "value": "256174d77847a88c68bf19ed54fee92c88ceeadc9b42e9e75d00582aab615d7db36762e1d75b13729deee4da02b3b6e3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385263, "uuid": "5d562151-8895-4d5c-bba9-cd32562f4c39", "value": "36F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385263, "uuid": "ce8ebca0-1ccf-4b3a-a23d-eeb9afb3dc29", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385263, "uuid": "af711183-65bf-458d-8487-386380beecd7", "value": "3072:cUmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:c9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385263, "uuid": "cd1295e8-92c7-4c4b-b0ce-bba40a7525da", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385263, "uuid": "b9a9ebab-1eb4-435d-ad39-fe0c228d856e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385263, "uuid": "3e794cf8-e285-4b59-99fa-6361d62614a4", "value": "2b2e5288_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e685d89-af27-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620386972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386972, "uuid": "1ad0f88e-8338-47c1-9251-891c46722375", "comment": "Malware payload (AgentTesla)", "value": "bfd58154c89b07862ee3088fbc07f255", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386972, "uuid": "7ac6735a-e0da-4cac-8e7e-0aacbb6efeeb", "comment": "Malware payload (AgentTesla)", "value": "5a115b193cd8584c561a8e9ef9a1b65a7e4a7e9eef19d2607f7ee12588f38803", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386972, "uuid": "427468e6-434a-4fd8-b1d2-80e96033dc22", "comment": "Malware payload (AgentTesla)", "value": "62fde75198a4b2675191679b340c7ff13cfc3698", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386972, "uuid": "3959e62e-d404-4094-8a95-7451cde0b54b", "comment": "Malware payload (AgentTesla)", "value": "a33a5a0d67ab36a027db63b5a3e247ba9f1d1f3944ebf11d268de1f341676938e2a8a334cb37ff7d8cab6575b40bb2b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386972, "uuid": "0d6fb239-3548-4dbe-82fb-51776456b602", "value": "A5F412AD1BDCAA20C5FDAF34A4A1425702B1F4525E23E73C2EE435B759737E0CA123A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386972, "uuid": "78834b9a-bcd3-4d9d-bc84-6b60c27281c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386972, "uuid": "0e45d2d6-7275-4b26-9d27-aaf875e42195", "value": "12288:F/282EPi/hUVSZ+gm3oIYt6efqATmGti0VzJItsPOgee7+aayKxzGbvpM:MbEPi/hUVmhaoIi60D/n9IeCaazzG7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620386972, "uuid": "9f268abe-141c-49db-b7ef-14618da27f9b", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620386972, "uuid": "b4731b42-c4db-406b-9ad7-fc70d6672fde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386972, "uuid": "95f925a3-41fc-40f0-aaf1-cde136d5bd5c", "value": "image002.png@01D4EB98.FAE33E60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9218a0e-aee8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620360120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360120, "uuid": "f3744094-fc17-4962-80c4-b3b1607cb150", "comment": "Malware payload (Dridex)", "value": "ec0f3d5aa66f8a0a3e3e939147d5a1cb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360120, "uuid": "7eb57f43-7a47-42d9-83fa-1fe8107e8b2d", "comment": "Malware payload (Dridex)", "value": "5a1c8207a576c90161064b43fe7de2d039312f7796fd92814c155c8500c5a232", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360120, "uuid": "5e0265dc-4213-42db-a7fe-77bd743006d0", "comment": "Malware payload (Dridex)", "value": "044fab0ab75a8642572678163f412ba1150e43f8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360120, "uuid": "f93f148d-70f6-46d2-8105-577d73539391", "comment": "Malware payload (Dridex)", "value": "2796a16fcb02b3df6515411a92a09872dbe1d99fd1f01864af59d22af0a3ad3d935c66ccb74b8547aafda10cdd9f2fb4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360120, "uuid": "377a5848-c61b-44d6-be47-f7afaeb4debd", "value": "D3F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360120, "uuid": "1873cdb9-cec6-49fa-8588-d5f6eba396af", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360120, "uuid": "27703de5-24f1-4688-992c-09c3f3bb09d0", "value": "3072:3IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620360120, "uuid": "643b2925-4d51-418c-97b9-5a0aee51bbb6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620360120, "uuid": "a6e1e1fb-f7cc-4a2b-b30b-ec498ef3e8a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360120, "uuid": "a5c6d964-b5b0-4987-a347-4320b2abeb7a", "value": "ec0f3d5a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155ddbdc-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403546, "uuid": "07619a4f-a35e-41fc-ba7f-efe42160bb61", "comment": "Malware payload (Dridex)", "value": "52bcd79a81ee66952b632472d714d91f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403546, "uuid": "7d65a353-bf73-42eb-9ac4-4fb8e5058b97", "comment": "Malware payload (Dridex)", "value": "5ad7f33e06bcf2c95a6251645d71edbe2a35fc2a4df1e27e1ebc1868be7ccaa1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403546, "uuid": "615833b4-8028-4419-8904-eadb39a0f79e", "comment": "Malware payload (Dridex)", "value": "3a0b532bd68f581300d7ae7c3ca2f82bdb525e0b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403546, "uuid": "0e1a0f57-2a84-4395-837a-ecb5eba83cb0", "comment": "Malware payload (Dridex)", "value": "4126136dfcb934d63e8ee7117d86126f0cd5f95268603c5dcb26b13d2d100b5541df497e0c5140ac3ffe8f949f772de1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403546, "uuid": "48868f28-0090-4783-9ecc-ce29d9080ac1", "value": "ECF3D081E78ED5E0FC179B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403546, "uuid": "7b4d7afc-a9f4-4e0a-93f7-99c8b1d298f7", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403546, "uuid": "3db6b4dd-3b49-471e-a132-e5516655e0da", "value": "3072:qBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHgR:auXLcclWEc2HeSjNjGdeAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403546, "uuid": "df359da3-5eec-4aa8-9eea-524a61f7130a", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403546, "uuid": "835ff7c2-1cf3-4667-b8c5-bb1ec404dec0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403546, "uuid": "f8868caa-5c89-421c-a3ff-eb107d942e52", "value": "52bcd79a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f91b278-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403697, "uuid": "ba37be08-963c-4b7a-bd99-3fc599e4b5df", "comment": "Malware payload (Dridex)", "value": "9234565f31d5f1e5c742094dac1286df", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403697, "uuid": "fb91d403-2430-45ef-ae92-318180cfa540", "comment": "Malware payload (Dridex)", "value": "5af91680581f2bb3866f318fc27c3eec989fae2f5d8b7a4c2caff74c56c0cbf4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403697, "uuid": "d875ef5c-b2bf-4fb2-ad28-57a6b611bfa8", "comment": "Malware payload (Dridex)", "value": "089046ae07a1711e62ae7f6043148bde44b72cb3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403697, "uuid": "0568a942-c5f6-406c-992e-7220888d9528", "comment": "Malware payload (Dridex)", "value": "d3e8f07b5cff81a480468a2e866b1ed63ca7a676fb4f8e72609b6a8d8c11f41d82fa10b881ca7dab666c3fad899a4b56", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403697, "uuid": "4dfd2c5c-4775-4c43-984b-7567e1367761", "value": "BCF3D081E78ED5E0FC075B333EA80EEF52710087691854E4EF29DABDD6BB7E051A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403697, "uuid": "70ee72dc-64fe-4bb7-badf-cf039815f91d", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403697, "uuid": "08dec4e6-265f-47fb-bfd3-aff03bac909c", "value": "3072:LBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHVR:tuXLcclWEc2HeSjNjGde1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403697, "uuid": "03270c39-6495-443b-89e0-e4405f00703c", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403697, "uuid": "24ebc12a-76da-408c-850a-ecba5111f2be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403697, "uuid": "e75cffb9-17d8-40e5-9808-bdb33a1475b5", "value": "9234565f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f27c141-af41-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620398194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620398194, "uuid": "9e5070b9-6890-48e0-a77c-21695a023d8a", "comment": "Malware payload", "value": "b914191790e95cb750aa39c8d887260e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620398194, "uuid": "d5978d13-ea04-4d57-821e-3081017516c5", "comment": "Malware payload", "value": "5b2fad0f854eb3754896f424cdf485ddcab5c136c8f0783f0b90c74f526f0ca9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620398194, "uuid": "7f4f5c2e-8035-427d-a5a1-dc0017f9b50e", "comment": "Malware payload", "value": "0698a2e1d0b2709053d059dee7a88d57792df419", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620398194, "uuid": "a111f9ae-7f97-4075-922d-2db79f075246", "comment": "Malware payload", "value": "638b0d79346168f7a88eb19c9b08ff85efda21eb6f9ae21b2611e898d6d78db8af14e6695039e63e929b4a1261c685bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620398194, "uuid": "f2768087-706f-4f40-af4c-f406a38b07c7", "value": "47C43906F7A489A5D033D139CAA3874AEA727C684B2047C76281F72D6F376E15D3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620398194, "uuid": "d270446b-c0b3-4e81-9ed0-549877b171ac", "value": "eddd8719f9a456c56722eff39390eaa9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620398194, "uuid": "91d2cd24-cea8-4fdf-977b-cba1fcc60f36", "value": "6144:e84k0I0tNHhoHxA6u5puWd4uJUxAY5oZO1gschw8r9vmyP9gTS7hzEVYd:eTtIaHhh6u5byeeoj7vmRehIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620398194, "uuid": "d1145412-a234-499e-91dd-a8ea6973c987", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620398194, "uuid": "830cf8a4-2056-4647-94d4-fdcf73f87c63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620398194, "uuid": "614609eb-a6bd-4a5b-a213-091507527157", "value": "\u4e2a\u4eba\u5de5\u8d44\u53d1\u653e\u660e\u7ec6.Excelt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3768e2-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404046, "uuid": "b29b77e7-40db-4df6-be60-707382d0f0d6", "comment": "Malware payload (Dridex)", "value": "0e2260c5cb93bb2c23137fcffc8e5a5c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404046, "uuid": "0115e511-4644-4f40-bbc1-a4f342a5ce1f", "comment": "Malware payload (Dridex)", "value": "5b4f1446e629dd0f5fbf67682ad4d54e89143db32531d20a68dd9e080e94fe83", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404046, "uuid": "31baf419-5a1d-4460-9e8e-5a3f2576a744", "comment": "Malware payload (Dridex)", "value": "c15d328540a3aa13ca77feb44965992a4fd16254", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404046, "uuid": "4267c42f-0af9-4162-9c92-810134a03166", "comment": "Malware payload (Dridex)", "value": "7e6cd12e378aacb22997d68314e173dd3a1fc59468f11b53d3b055cd3b94df736f9900f40c9856f9e7034f2017862860", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404046, "uuid": "395c6f18-6a5f-47a9-9475-1972aae64d73", "value": "1EF3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD5BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404046, "uuid": "6698de4f-ff7c-4174-8cb9-67ff551818aa", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404046, "uuid": "52a34a85-8cbe-4632-904d-9d03db49b084", "value": "3072:XBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHOF:RuXLcclWEc2HeSjNjGdeuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404046, "uuid": "00b6bdb7-5f86-4fec-8718-eed876db7e6d", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404046, "uuid": "ee0e252d-28ab-473d-9c7e-04d4440ba7b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404046, "uuid": "e576dc5d-e37c-41e5-ab34-303b64edb4c1", "value": "0e2260c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e974a5-af86-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620427617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620427617, "uuid": "17b7d09b-d393-40ce-bbeb-f4142e7f3776", "comment": "Malware payload", "value": "28728a0d841665bb0a201d82e9634ef2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620427617, "uuid": "a43f2862-d288-4764-b747-7a026d6d1d6e", "comment": "Malware payload", "value": "5b5f82b8d45b6737cc0241564fa1292ff45e8503866a3d430e7fa3ced1881af1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620427617, "uuid": "a0ce8616-d4e5-4181-bd0a-9b52c3818029", "comment": "Malware payload", "value": "9faf04508a63603fe99401ca51098d7eb64f497e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620427617, "uuid": "04290280-2db7-47d5-a491-13ee20265195", "comment": "Malware payload", "value": "5e8d28ed90f867d4644a68314d98f29b9127f6d3eadd480aa39b2ccf3845fb340145fcc854b26a1b23bf220ca567dd7d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620427617, "uuid": "03401a90-482d-4064-94f2-78fef485981b", "value": "C9D533D5B47DF99CC5DFC3B9CD5DA468977B2F87ACE607D00A42A264A7F2061048B0E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620427617, "uuid": "21f0c84e-32c5-4835-8150-4175571d1600", "value": "49152:Dd9ORXcg/UeaE9wJB6X3RIFNApUz5EOK+Bo0ZSiTWI8d4HWxepluX8hr6GjuH1CE:3Ycg8eaE9wyhFpoEOK+BodiVb/8GjuH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620427617, "uuid": "4d8d5250-5e23-4fd9-bb49-c0c078ed883e", "value": 2823282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620427617, "uuid": "5c96c659-8631-4357-bdd6-f083dd90075b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620427617, "uuid": "bbdbdf7b-e6c7-4773-9104-a39cdee1c0c9", "value": "SecuriteInfo.com.VB.Trojan.Valyria.4579.10155.1886", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06a4ab0-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407350, "uuid": "127f411d-fbaa-498d-a7b4-086cb10aa91e", "comment": "Malware payload (Dridex)", "value": "f9e6c105a906769c6ed32ed65a032838", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407350, "uuid": "34588b97-8281-4cd1-b420-ef84814d590a", "comment": "Malware payload (Dridex)", "value": "5b72a77a8f2b5ac4a32fc6bfb000e055259f9e0a9de870a06a0bbcb8174ca98a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407350, "uuid": "4913c04c-e4bc-4438-9c41-3a84b625b138", "comment": "Malware payload (Dridex)", "value": "b743b3f6ed1acce8d6aabefaa98de77195885bfd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407350, "uuid": "5338e10f-d148-4380-b896-0d228858f0cf", "comment": "Malware payload (Dridex)", "value": "4352f1b28367b7358a02beb6528cb4b9ba8b8b929888ff882141170bcd202a4268c2b1582edabb1b16f3a24ea0d998ad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407350, "uuid": "424acba3-d971-4da1-bc51-2e13fa3a10fd", "value": "A5F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407350, "uuid": "fc99c95e-ee5d-42ad-bfb2-ef675a0dc7cb", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407350, "uuid": "ec472136-9225-497c-9fde-4396b96cc7ad", "value": "3072:wBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHC/:EuXLcclWEc2HeSjNjGdei/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407350, "uuid": "721df7be-26ce-44c0-8847-b53196615731", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407350, "uuid": "c777e68e-a1ed-4c2a-9ebf-1b3f18b6a548", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407350, "uuid": "2152ec13-ef41-45a4-8af8-685fe8062aca", "value": "f9e6c105_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb91a51f-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392229, "uuid": "2b2e2d4f-c8cf-467f-8754-fb41f82868cb", "comment": "Malware payload", "value": "6fb28967229bb686ecdada7e76056f77", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392229, "uuid": "1fbddada-cbf4-4536-8477-551fa2cc2091", "comment": "Malware payload", "value": "5b9344858da76b8659ea23e2313a96ef4e90bb4dfd6af33d0439cc783dca0a61", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392229, "uuid": "dc9842af-0f24-4310-82e3-71ecf63ebfdf", "comment": "Malware payload", "value": "1724b3463bb45f7caa8a19cb60d2821c05d94499", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392229, "uuid": "857e7a16-94a2-494a-8510-3ec203811685", "comment": "Malware payload", "value": "c579462a097a1ad879bf42dd3b26a3b73ed6e2fe103d58b344f72ba0c0ccc2b22dbe31d2c6193cd7bdac8df3b8c93068", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392229, "uuid": "35f11357-6d34-4cf2-8ccf-352229b82396", "value": "68B42303B9D12DC87488EE172E5D510E8145FB8F606CEB8701C5A66A745E25C6FA337F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392229, "uuid": "239ec44b-8acf-419a-9b61-bd1fc4eed63f", "value": "12288:a1Hx+tbbZpxMj3urJSwvhgUXrgt6gmVB0xuP+G3:a1HxKBpxMjuBd5QUP+G3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392229, "uuid": "bf814360-423b-41c8-9f97-b2cd44b54096", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392229, "uuid": "df33d1e6-add6-4c29-9afa-3219c02f3209", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392229, "uuid": "04f23100-1afb-4f76-9360-80a59b5c042d", "value": "5b9344858da76b8659ea23e2313a96ef4e90bb4dfd6af33d0439cc783dca0a61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0635df5e-af88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620428431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428431, "uuid": "e431680a-136a-451f-b3aa-d6d109fb8ccc", "comment": "Malware payload", "value": "b7b5882f5ba97a0c9e04b304beed49b0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428431, "uuid": "b722e4a8-1fee-45ff-b045-98b5655d2408", "comment": "Malware payload", "value": "5ba7e7d68ca42992dc996686e3b44c303be8dde58a6c626d01cfbc306f4dfec3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428431, "uuid": "f959cb53-3ba3-4600-847e-efa4f38492a4", "comment": "Malware payload", "value": "bb4e9dfa87b286a5a74f3873ffa3475e7e76a4ee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428431, "uuid": "45df54c6-9248-41d4-9ad6-b717bfe68693", "comment": "Malware payload", "value": "1b3d19386d34e088b676da8446e6d940d4973f15e443b020c8c9038c640f49c9b89c3fa1512f29d26a654b69e14d10d2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428431, "uuid": "30a5af80-228e-4b89-ad27-31284a51a517", "value": "C7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428431, "uuid": "4f4895f5-ffa0-4bec-9432-129796c63ae4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428431, "uuid": "091b082f-b8cb-459a-bdc4-bd7550cdb7ac", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620428431, "uuid": "f11b1b22-b565-4d02-8f55-d842f3f8275b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620428431, "uuid": "38b1a4b5-d783-4aef-a190-fca8965e069d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428431, "uuid": "c7f318a4-6200-4263-8791-839d67f5f6af", "value": "b7b5882f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc722054-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392230, "uuid": "d3aa28eb-8861-4b49-9f9d-f6082a601f9e", "comment": "Malware payload", "value": "a8abb29a85d2d03c4cf96431a0930870", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392230, "uuid": "1258c560-02c2-4062-9e79-174374563fa0", "comment": "Malware payload", "value": "5bd3256e679c62778f784c3694a8837ec35dff34207e1eeae400fcff4b7ee220", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392230, "uuid": "b6ae0774-c57a-4834-b8ec-7eac978ec360", "comment": "Malware payload", "value": "310ebc3ad171bd764b17e61ce02c4f31dcc740ba", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392230, "uuid": "c595595b-325c-4dac-802d-e435f9725c6d", "comment": "Malware payload", "value": "dc985dded749b872b22aad69dbea7cc5ebe2a93624a81b437ceab5fdf7fca78ae4b0207cb8bf41c3003d737d93fe6c74", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392230, "uuid": "50c1627e-706e-4875-a709-341f18d7244d", "value": "BBA1F750112C1AB07346697AD26FFB52B80EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392230, "uuid": "bacdb9b1-834e-4a82-9bd3-e98b319255d8", "value": "96:iRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:iRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392230, "uuid": "3479eff0-5a9d-4006-95c5-02edd022f9a8", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392230, "uuid": "a03b0acb-3bd4-4f37-96d8-b01435ce3f81", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392230, "uuid": "974eca4b-4270-4b44-b250-d6554a23a4c5", "value": "5bd3256e679c62778f784c3694a8837ec35dff34207e1eeae400fcff4b7ee220", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c7f285-aef9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620367258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367258, "uuid": "8df716f2-42ac-4a5d-871f-790995b7759b", "comment": "Malware payload (Dridex)", "value": "6eff9b8244df93bfef0146fd7380f1e1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367258, "uuid": "f986b801-e91e-4999-ae58-016af5e404a5", "comment": "Malware payload (Dridex)", "value": "5c24ff063da7a52d2096deb0c0e0d053192ffebf3ca64ad30361e5048f3190a2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367258, "uuid": "2f614ce8-7359-4c97-b573-a58eec55f8e7", "comment": "Malware payload (Dridex)", "value": "a5359f1d8ae25cfe858210a25e661958b9ef075c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367258, "uuid": "4faaf627-6dd4-40d7-be88-32aadfc45e7a", "comment": "Malware payload (Dridex)", "value": "e34a6e5e2cbbefab37e57f15d9dea9d17549e5d0f1109b121a666878ef8595041925303e39db7c916797b7cde50b149d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367258, "uuid": "ba7dd423-3085-463a-841f-2afe230bcc94", "value": "71F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367258, "uuid": "43657beb-a46b-452f-a180-fa3c976cf7a2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367258, "uuid": "3265183a-34c8-4242-92f3-1f7ea832c7d1", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620367258, "uuid": "4c89125f-4102-47f3-bb0f-babd719d933a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620367258, "uuid": "6a5597ce-6556-4656-9fa3-d726e366ac58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367258, "uuid": "0936261e-7383-4480-95a3-2af97ab9e6c4", "value": "6eff9b82_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67be61d4-af3e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620396812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396812, "uuid": "32923409-8dab-4d7f-b47f-07f20508177b", "comment": "Malware payload (Mirai)", "value": "d1da8ed6bac68881ea24d1195ae547c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396812, "uuid": "1fc92681-9537-4a93-a746-886554e6aad7", "comment": "Malware payload (Mirai)", "value": "5c33c5e34b9243abc8697392b9c491a81eac1d94c8870d58595fe9afd30d915a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396812, "uuid": "3865298e-778b-43d2-93b9-afbf8d0e3c6b", "comment": "Malware payload (Mirai)", "value": "5cda839721f2834b99d6972ee279b52bfd2d4ee5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396812, "uuid": "62573244-24b3-4b11-aaed-766126b229b7", "comment": "Malware payload (Mirai)", "value": "6efaa01b00033562e70fdc87b85980fd7c0d38e794ab301f864e8d14f50d4643479c3ffde8e7b2447caeb52c6174ee5f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396812, "uuid": "1f2be406-c72d-4f2f-8776-cc82544ce9a1", "value": "0263961A3E218FBEFBAC863847B74A219658339622F1C5C4E15CEE015E7034E745FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396812, "uuid": "bb9b51eb-ab66-4f8d-8cef-427187cb590e", "value": "1536:AHNFnXDuPq/SyZBp9tsCI0v6bqfg/Kkz73o2x88W:gNFXDKGrJI0SWYz73o2OH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620396812, "uuid": "58860a16-3ba8-45c3-aa06-4a5b231fd89d", "value": 69080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620396812, "uuid": "4b06b4bd-87cb-4834-ae34-d28b604b1e9f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396812, "uuid": "7c8632b2-2f05-4afa-981d-022a4e4a620e", "value": "Josho.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2075b6dd-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407430, "uuid": "1f8b2997-4c77-4722-822a-21ce4cbe8115", "comment": "Malware payload (Dridex)", "value": "9834d924e968f62a70e5738afb2d8d35", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407430, "uuid": "be2dc9a0-5711-46ce-9d4e-c2bce58dc82e", "comment": "Malware payload (Dridex)", "value": "5c4eb94e0205169d7a44cacecbb6e818a87960eab26d2bef486407d058a631bd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407430, "uuid": "52254a97-e8b1-4ef3-9853-0a2b44ce798d", "comment": "Malware payload (Dridex)", "value": "925e8cc1886b46448f3ec4cb92864db5fc7a8a1c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407430, "uuid": "da60fe88-eaf5-4bac-9168-9e8b85052218", "comment": "Malware payload (Dridex)", "value": "24469db14431513dda073a397a968977a9e9e23ff0d2461776be56c42ef8bf41023cc3a4a3b4e27133c4d6b6c12fdd2d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407430, "uuid": "fc752487-4a88-4e00-8e85-641359e54de3", "value": "D5F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407430, "uuid": "ca33f13b-712d-40fc-b6c2-e5f7c17c491c", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407430, "uuid": "19add34d-a79e-4234-bab7-f9db0a4297c2", "value": "3072:mBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHqE:euXLcclWEc2HeSjNjGdeKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407430, "uuid": "bc0e3c82-5054-4a25-a7f9-56947cd5e244", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407430, "uuid": "4689a4ec-f5c3-4a10-8338-8ecf256a542a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407430, "uuid": "86e6e2dc-0ddf-4e6b-bea2-0a0fdf629b63", "value": "9834d924_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07eebb7a-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407389, "uuid": "881c3443-8750-4616-9060-b38da29ea6a4", "comment": "Malware payload (Dridex)", "value": "7b6f0d24bfe6a680101d2672a3474514", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407389, "uuid": "7ec3cf61-5cb0-4b4f-b056-96d66fed7890", "comment": "Malware payload (Dridex)", "value": "5c672d1674985bf0c12fd1d47cf7b5b4ec65d9568a93f5481fa2e03c2fb2aa9b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407389, "uuid": "22695eba-ca90-42cf-8ac0-cb543530764c", "comment": "Malware payload (Dridex)", "value": "5b2f9af8e72bcacb33b0dda1d6c7f2c78e6a2c37", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407389, "uuid": "817a4c9b-f756-41dd-8d74-3e5dcd8a4a25", "comment": "Malware payload (Dridex)", "value": "3b50922454b48885a86626b2b22d4215e37ecc9bcdf915c9571158ee613034e913f21d052ea841f68eecad1bbd190733", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407389, "uuid": "ceec5048-c013-47f0-828c-295e63910f40", "value": "7BF3E081E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E051A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407389, "uuid": "8f0a825d-ced3-4dc2-8204-87a99524cffd", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407389, "uuid": "35c37ff5-7916-4ced-9340-79fb9b04d0fe", "value": "3072:IBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHRX:MuXLcclWEc2HeSjNjGdexX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407389, "uuid": "5a972d10-8788-4d2b-bb5e-5ad12d108328", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407389, "uuid": "05558a40-e656-408b-bdd6-cad68fcf5f7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407389, "uuid": "bc064783-5733-4905-aab3-553dab0adee0", "value": "7b6f0d24_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2461f7ce-af88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620428482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428482, "uuid": "bc11e175-718b-4e93-a725-67e5a7565b1e", "comment": "Malware payload", "value": "bd1420382f08feae79f4142212340fac", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428482, "uuid": "31fb9ee9-0d98-4d95-bc51-2d01e19ffe81", "comment": "Malware payload", "value": "5c91cb14d92522dc88a934dad1df29de0f3a2a924a7d8c7f02166d7e45143cd8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428482, "uuid": "ff1a0be2-6e21-4536-9394-412a3bb9fa81", "comment": "Malware payload", "value": "734e64bf369d305717911901f3af465bd47eaa38", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428482, "uuid": "9219914a-8ad6-477b-9a8d-53a13bc8ae25", "comment": "Malware payload", "value": "939af47634606c69eabf734546e6cc9d1ba56fdb421d0b3d1f098433dbcc9e5773b2b52008ac0bde97beb441e82ef3c2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428482, "uuid": "50ff2cd2-f38a-4a0b-8f8b-e1f22647e3b2", "value": "99F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428482, "uuid": "9ec27de4-c14d-4499-8336-d20dc371f89a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428482, "uuid": "1e9456db-71e7-487c-81a1-bde4de175fa6", "value": "3072:olpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:olo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620428482, "uuid": "b91a39f9-aa0a-4aa5-bd45-03e8f580b2fb", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620428482, "uuid": "61d9b295-eeb9-4108-8b79-d8b2f7f0995f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428482, "uuid": "19a5e586-8e35-44af-a895-00be78c7ab73", "value": "bd142038_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f8b2f5-af24-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620385859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385859, "uuid": "5a691ab9-3d16-4b48-a03d-6c83c8ab858f", "comment": "Malware payload", "value": "1cd1defd8e963254a5f0d84aec85a75e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385859, "uuid": "081f5ff8-61c6-419f-9886-128b8eaa9348", "comment": "Malware payload", "value": "5cc691ddb8accd10a0eeaddc6d6f3853e2dac335e452140c26dd02ba312cd1a8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385859, "uuid": "29b2aae2-4f48-4ba9-9d30-dbfa3e35b4c8", "comment": "Malware payload", "value": "fb0f7f965f0336e166fcd60d4fc9844e2a6c27df", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385859, "uuid": "7817ba2f-6488-47b0-aaa5-4fb548d3a7c2", "comment": "Malware payload", "value": "020eda9dec71895cd30c6375ea03146400a50433e340cdabe16832077c9542e7f154cdcec5b73aed8591c412ddc8c76b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385859, "uuid": "8defa665-1b7e-458d-9499-29c44056444b", "value": "30730187EBE049FBD0F1D8391DE72285E6FAAE751D2A875390651C4E6F393906C08327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385859, "uuid": "03952e8c-242c-4819-985c-01daadf424d0", "value": "d609a88c9c1c0b83071e61f9c45f78d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385859, "uuid": "b80b8372-20dd-4788-85eb-9e26ed647590", "value": "1536:s2qyK6nJjTpvWzt7p8AeAPJ2+Z814UZ0ga0NbYRQh9:lrTvWzt7p8AeUwAhqFSQh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385859, "uuid": "12a7fc5f-5610-46f9-83cf-37e804ad6f6d", "value": 77097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385859, "uuid": "0f1fa42c-9b60-4645-858e-8ea7367f7ad7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385859, "uuid": "8ce2cc5b-c84f-420e-86c0-1a7887955372", "value": "jet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5653d37d-af77-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620421264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421264, "uuid": "7d691908-2cfb-4399-88e2-29343c6beb41", "comment": "Malware payload", "value": "4ba32d5cc707bd486d392ef29d97b592", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421264, "uuid": "637f995f-5246-4a71-bb83-cb68b6a489f4", "comment": "Malware payload", "value": "5ced96a9366760064a9e8d088e1290a4a69f346e428999ca97baa3d771ac8aea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421264, "uuid": "0693691f-f6cc-4604-b29a-f5fec95cbfd3", "comment": "Malware payload", "value": "aee3bf3b7de0ea920acbff42838420fa811c622e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421264, "uuid": "bf94fc61-ab6d-4291-98e6-e91091b33ef7", "comment": "Malware payload", "value": "e1a403b2360cd399661293f62d078b3f350935d91193e755c13d400667993667a577dbbfb22b5030045415e7fba2723e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421264, "uuid": "f2096251-ae55-489c-9a8e-12160969e57f", "value": "24F3C088CBB3E4E6EFB2D37976F85E1B460674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421264, "uuid": "ce5b5a44-3a29-4f5b-b0be-425f612d1bfc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421264, "uuid": "0c53a966-2b06-49a6-ab76-196facadc4d2", "value": "3072:NIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Gc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620421264, "uuid": "acbe08b2-ccb4-4fdd-a773-f7c66f6bcb06", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620421264, "uuid": "07dd5c36-20a7-4b68-bfdf-065b1ea386d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421264, "uuid": "69279884-f71d-4a8b-9b81-9938ab75293c", "value": "4ba32d5c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac62bf0-af39-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620394885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394885, "uuid": "674c44c2-0181-45e5-a14c-7a91d1218ecb", "comment": "Malware payload (Mirai)", "value": "e5d3a6c142ca67d09ffe93d61f770224", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394885, "uuid": "ed0010ab-7915-4d7d-8f71-b6a5c348defd", "comment": "Malware payload (Mirai)", "value": "5d5f9b368f5a47d0c242ffcf2a1469c47bc17c6309d5a5b7fb6f8ce115c6aaca", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394885, "uuid": "65a97791-d326-4cb3-9056-94d62f31022b", "comment": "Malware payload (Mirai)", "value": "dce7f70407c4f74d37df0b7c8291400c21a505fe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394885, "uuid": "7468ae03-570e-43fa-a257-49bb3f3f8413", "comment": "Malware payload (Mirai)", "value": "23e722ebe0b193fecad417476ddf2f79c205ce827493207b34c1df6fc86780de00e164b5ae8059a3aeedeb06150acd2d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394885, "uuid": "c51c6bb0-eb75-4440-b27a-dc8a85cbecee", "value": "C94309C17881A626C7D05777FA6F018D37199798E0EA33538C295FA07B8AC1F0D6774A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394885, "uuid": "ed05248a-65a6-470b-b09c-9e97b19e8f31", "value": "768:N1c82KhvRRTdj7tsq5sebD07B8drbonjxDdSYGSq/EanRP89UapvTLwCVy/rCxH8:Nb24Th7ttujxynRP4U8ShW+15RL+Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620394885, "uuid": "b3fdf8dd-b255-4ffb-a738-2ff01e2ec9b0", "value": 56584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620394885, "uuid": "26e37ea9-5048-4190-8790-4b7cb8d29b4d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394885, "uuid": "07643b57-b19f-4df9-a49f-0d14966b03f8", "value": "Josho.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21081fbb-af02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620370924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370924, "uuid": "1aed40f4-df49-4213-a3ec-2702c40b8602", "comment": "Malware payload (Dridex)", "value": "01b6cc2f7a8c4d00ba62402f3927e292", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370924, "uuid": "86a8909c-21f4-4b04-83fa-7e50266ffea7", "comment": "Malware payload (Dridex)", "value": "5d659d25fb2ea3454a9ba32be4b42c169a5b82eaecd6407e4a706fe5fe90fa8c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370924, "uuid": "b79d7ab7-6220-4b92-87c7-bb0b9b37bbb7", "comment": "Malware payload (Dridex)", "value": "794681cc4b508d186700e6c333ec5d6e630c21c2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370924, "uuid": "e32171f4-a118-4928-84ca-1c4888a17a7c", "comment": "Malware payload (Dridex)", "value": "233416555316f001ed39391786b51a294341f84630c469df086e9188631c084ca4e59bd0ccf3df55142558d363232d82", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370924, "uuid": "d271708b-d6a3-4b77-8a60-c4cef6da8c38", "value": "31F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370924, "uuid": "7dec2197-23d3-42f9-9c9e-c95f9c147d4e", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370924, "uuid": "91bb02c4-1cc4-4265-ab7b-6fcc40a57c18", "value": "3072:wA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:w3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620370924, "uuid": "3dc0e26e-bb90-430d-b88f-e37e1f493a9b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620370924, "uuid": "996cd559-0bfe-4a9b-9431-778dab4e87c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370924, "uuid": "83553220-086c-4b7f-9279-a3d7d5579555", "value": "01b6cc2f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d30b8e2-aed8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620352932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352932, "uuid": "83375e8a-b266-48ab-9265-94a1a9085792", "comment": "Malware payload (Dridex)", "value": "b0e99e8196aacdb0d92e948a196caade", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352932, "uuid": "bb9b807a-423f-454d-9119-bc1f5116c175", "comment": "Malware payload (Dridex)", "value": "5e0133171d9ad9e5a0db6587b8422b046659ace60c563befd8e46e4919b4b873", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352932, "uuid": "3796e190-0745-4941-9f80-ff136639c40c", "comment": "Malware payload (Dridex)", "value": "4ceca7af14896e127512afbeca46eb934292b5ea", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352932, "uuid": "fc3d05bc-35d3-467d-9f15-4bb5842b6593", "comment": "Malware payload (Dridex)", "value": "b2932c99b69e2b2c1fc654c2b4407ba3edacf9e7e601ccc007757462d1a7ef30bba1f9a2b84c3ded0e77510ab2d9e5d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352932, "uuid": "cec83c61-c6c6-44b9-a69a-26e25cc86df1", "value": "C8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352932, "uuid": "b79c8f0c-0d05-481f-bd3f-729db9113fd3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352932, "uuid": "94ce3904-7b74-4bc6-a1b2-090ff6ac4623", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620352932, "uuid": "a1c1ec72-6a60-4047-b0e8-032d07dc742a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620352932, "uuid": "8348a4e5-8523-49ba-9c9b-7b566a05980e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352932, "uuid": "a2b02365-6e01-49ef-aec3-b120ad1acd26", "value": "b0e99e81_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f00dba1-aed3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620350707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620350707, "uuid": "8f8e2b33-bbca-4863-a254-26d7b46762d6", "comment": "Malware payload", "value": "c340305243a686b51804d971ea98eb58", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620350707, "uuid": "84fffecc-6105-42c6-b38b-5cc1edeb99c8", "comment": "Malware payload", "value": "5e4c6ac84b748a87ad634ae0b05095487272d08e47ca62538e07e83e3e9ca7cd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620350707, "uuid": "d9af9952-3233-4f83-9ae5-53adb1e1ed34", "comment": "Malware payload", "value": "b097ab251863dc844a79dcbee454548baa08d58a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620350707, "uuid": "ccbc13e5-c01a-4330-a7e8-a357d02e0fa6", "comment": "Malware payload", "value": "a835e9fc6916801a4dd5d4f5ee4c0d9a6115ad9ce7231f8375e1128c65cee6debd087a58b681cfe3e3233c5a698e4dd6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620350707, "uuid": "7b816fb3-90d2-4103-b4a8-70e561617fba", "value": "F77140322B9384BAEFA20D7E5CC385AA47862742171004D7AB9705DD5D29EDFE438762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620350707, "uuid": "080d0e9d-1d16-4f73-b629-f90edd06dbbc", "value": "629226d8e472a1ae0b72004a144bb7c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620350707, "uuid": "b89843d3-a311-4850-96cf-40aaa5bc0c04", "value": "48:ScN/Yan1AuXoKZ9poaQu5RyhuAEqpQiwS:nFn1AuXfbn2huAEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620350707, "uuid": "08385da2-a5c1-4899-996f-74dac33dbb3b", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620350707, "uuid": "a9bb4be2-7f98-42eb-86eb-36077945c650", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620350707, "uuid": "f8daebd3-2aa7-42de-8afa-facb899383d6", "value": "SecuriteInfo.com.Trojan.Loader.790.14969.27969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4783ad37-af11-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620377431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377431, "uuid": "53fc22f3-3a3a-4678-b735-963ee706e751", "comment": "Malware payload (AgentTesla)", "value": "33021fd6bd012cca69cfeb85abf14741", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377431, "uuid": "fdb4fdfe-06ad-489d-9bfa-881f2f2932ec", "comment": "Malware payload (AgentTesla)", "value": "5e6296315279b0819dca3ea237f0f0a6719d1d6aa7eb3cfc18c374608779834b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377431, "uuid": "2d884635-5835-4d03-9c90-18179308e268", "comment": "Malware payload (AgentTesla)", "value": "88ae14efa32c3b656f6f6ee42356060ff51ac01c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377431, "uuid": "04a0e1f4-610e-4170-af36-e9f2263ea1ff", "comment": "Malware payload (AgentTesla)", "value": "c6b95951f836553e8f7541dbd6e265bd820229f8c011e5d8bd41ce289831ea41b86c8e2929302494f823ba0ca9dfa732", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377431, "uuid": "08537bb0-1f27-4106-8838-18e0bf9fb567", "value": "A325BFB875047DE6267F576BDA96ACDD03B627628ACB94CD80A4B7C305A3371FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377431, "uuid": "2bcf3ea8-ea2a-4e1f-982c-b788cf3f187b", "value": "24576:lazoyhX0GJRoCHyTzInqOMGWPsWf+NDLCUxWM0XQhQ1/Ha5:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620377431, "uuid": "64a4619d-14a0-4a51-97f6-b45c05c4af7c", "value": 1017100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620377431, "uuid": "a657868a-fcd7-4f06-bc2a-454b04a9fc4f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377431, "uuid": "3d7ca747-1078-4be6-8c7b-92849bf2bf34", "value": "INQUIRY 71652628.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e25047b-af77-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620421278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421278, "uuid": "04a56980-9e94-452b-a23a-272d578859a5", "comment": "Malware payload (Dridex)", "value": "706f7f37e0bd5755329b49b14983eb5e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421278, "uuid": "cc2fad13-0e22-44c3-aaac-90ef12da2bf1", "comment": "Malware payload (Dridex)", "value": "5ef1519b1c370cc952931b31bfbef9a5f566b9bb9a3a736346d3eae756dd7252", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421278, "uuid": "da88f164-0551-4f96-b39e-c32ae095417e", "comment": "Malware payload (Dridex)", "value": "cc22c394be8e4f85e079124a699cb1eed401bd1f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421278, "uuid": "863e4744-64ce-45f8-b065-975ece6e7f1d", "comment": "Malware payload (Dridex)", "value": "48197dbbea12e1b5e709c049ab9769986bb3ee5d7faf9d597f135fed16538b5a0a00e51de19fcd8b4d9c21343cb230c6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421278, "uuid": "b09d9a48-5ef9-4552-8ee5-2cf7291729a6", "value": "C9F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421278, "uuid": "318b9a0a-b801-4aa9-b4f5-5eedfd3db866", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421278, "uuid": "24a9383e-3b97-4dbc-8bcd-1ebb71f35c60", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620421278, "uuid": "200dbf8c-9794-4e0d-9cd4-c9f9311e2674", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620421278, "uuid": "b358ebe9-3d4e-446b-9e09-9763801312ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421278, "uuid": "0cb083de-8c70-45a9-b5cb-afbb26773382", "value": "706f7f37_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d7bbd9-aee0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620356522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356522, "uuid": "f9432cc9-db8b-48d9-b95f-04e85ffaac99", "comment": "Malware payload (Dridex)", "value": "efb77edfcb285419663059b7291e107d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356522, "uuid": "fb9bb93c-5e58-4bac-b806-207379897efe", "comment": "Malware payload (Dridex)", "value": "5ef460368b0390679a55dca587374a04eb0c26aa3ccbd2b351313b67e6b44828", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356522, "uuid": "73897d30-b510-46c2-ae77-e2967c21b1cc", "comment": "Malware payload (Dridex)", "value": "b87c0fdd4cca8a34c3e3ee9bbbed5d1474f9045e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356522, "uuid": "ff5f4d5e-db36-4918-a2b6-7b95945e1523", "comment": "Malware payload (Dridex)", "value": "daf97fd3ad7a9e436e9f8d298fde0c037aea6d79e80effc62581759c3fe97ed4dd09f52b3af47fedf121b7b49cc02617", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356522, "uuid": "b3ac13e9-99c2-4c0e-a3a2-dfe7376932a5", "value": "DAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356522, "uuid": "58da74ea-3808-4f69-9adf-f2007ed28c63", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356522, "uuid": "7e745eb5-4493-414c-93b2-1c39bcb8b985", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620356522, "uuid": "10a46a96-349b-403f-bb6a-ce260949ff2a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620356522, "uuid": "ff92ab73-c172-4e3b-9b4b-dc1ff434e72e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356522, "uuid": "9c27a4dd-a3be-4b7f-8900-5e75d38c4964", "value": "efb77edf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00531d37-af6f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620417684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417684, "uuid": "33f18a4e-54fa-4bef-9a6f-2204b6aca7d4", "comment": "Malware payload", "value": "af2e73d50483dd49b73069507117b798", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417684, "uuid": "b22e1272-9068-4e6a-835c-b7de88e4b443", "comment": "Malware payload", "value": "5f1a47f7e929a6563f9b4d18dbefbab17942d63c9738baa0f1c4e9a25152fbb3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417684, "uuid": "1313ef4e-bc28-40d1-a799-d4524051193c", "comment": "Malware payload", "value": "e0d1ddbb33217aa9d8217a015b86c1bd7f368dbb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417684, "uuid": "d203fe68-05b5-4cf5-8fce-d80670bba3dc", "comment": "Malware payload", "value": "d949d5abf4fc14cc9a768139127666e23c408681127c004f084df21908aebe9f6bcb493287975bbb73efe736d32de720", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417684, "uuid": "ef87b32f-71f0-4b86-8334-00a85d6a964b", "value": "11642350A27861FCE0C27C3AED3071691FBE767B2A5FF394792CAE94B1361D4C5819A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417684, "uuid": "e895a64d-43c7-4d7d-b3f3-11122eeb3529", "value": "6144:uuaOvOhHMC2aToJfNdHOPRXxPU5OT2UF96ZbyjRbM3iCWxBR6:uIAM6sJFtOPDPiUF96ZWj+3iCcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620417684, "uuid": "b161cad9-c3d6-43e2-8ef3-6a7ac2e5bffa", "value": 331221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620417684, "uuid": "4dbfbe37-42fd-4046-beaf-d9c8c6e9ee30", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417684, "uuid": "08939892-b3f5-48f9-ab27-1919da5d97a7", "value": "af2e73d5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795776c8-aef9-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620367207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367207, "uuid": "ac6b8f6e-4080-4753-9483-b6b76ff7ecb5", "comment": "Malware payload (OskiStealer)", "value": "8ff3cd20c7ca5a373dc7b988e2668bb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367207, "uuid": "e45f4399-0cb8-430f-ab07-8f1ccea891ac", "comment": "Malware payload (OskiStealer)", "value": "5f55898f4f260025ec6507f92ed128dcd90f5f83d14b507282352f4c79fb71bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367207, "uuid": "d5a0abef-85cf-45aa-9be1-87ebad393c96", "comment": "Malware payload (OskiStealer)", "value": "a278ea762a0ade0c58ad49e9aa15075ef61e592c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367207, "uuid": "1c26ca29-6572-41c4-9777-db73cf41f423", "comment": "Malware payload (OskiStealer)", "value": "aa8705cc3cc718ab3ad350b9aa3b079f4c06ff36a7acdacec38a5e8195270d727f2d294ce0ef5232d3f3261ce0d46acb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367207, "uuid": "821cb172-936e-4fe9-aca2-78f891d21e95", "value": "694402045BC4CB0DC9320D72BEB6D230BA61AF41AD61D5A77913F26E4770B84D869F2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367207, "uuid": "bbc84dc7-860d-4598-be86-a8ff7a738f16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367207, "uuid": "c978ea7d-f186-4628-8e8b-adf59a31e8e6", "value": "6144:fIEATjJTVGetfUeAIQHuA36cd0soxQ8BRAn4WjSUw+67pOEB:fIEAhTVGeeeAItC66o/An4Wj5w+WA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620367207, "uuid": "9fe258c8-15ac-475b-904e-28587c234147", "value": 269624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620367207, "uuid": "1ab34d22-68c8-4534-80f3-9901228b182b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367207, "uuid": "dbf282c2-b2f5-4300-b1ea-00739a437897", "value": "IMG053110579.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3bae288-aee8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620360110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360110, "uuid": "95d929c9-3132-4e8c-913e-ab94eba2845e", "comment": "Malware payload (Dridex)", "value": "53e831c91dd6e7042fb80e5be3949080", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360110, "uuid": "a7632497-4cf9-4082-9c7c-c05ca4a32971", "comment": "Malware payload (Dridex)", "value": "5f9e3d214957bc3ca175c5ba25dd9b6c27ad2db50f1116f652f3118a86f9aa3d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360110, "uuid": "64fb21d4-dbe5-4bb5-a4cd-75ecf5010b55", "comment": "Malware payload (Dridex)", "value": "2e6e9e26ea2dabcd7867f6cef4e956411be7cf4c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360110, "uuid": "8b2afb3c-8c50-4265-9695-af430b662690", "comment": "Malware payload (Dridex)", "value": "7c765eb49f257fae5cf64a9a801c27277e0cd1faf72d95b460e8a1710b7ef7cb625eeeeb1212a271b1932078609bb4a9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360110, "uuid": "75bfe53f-3f40-434b-89c2-7cc2fe3183b1", "value": "E7F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360110, "uuid": "9ed16a2b-dcdc-4dcd-af54-2354bfc85b8f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360110, "uuid": "34591e8b-bdb8-44c3-ab41-4eae8dbbb5c8", "value": "3072:Ulpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ulo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620360110, "uuid": "b5cb10c9-eb2d-4caf-8c7f-6482173c4ba9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620360110, "uuid": "305837e4-6637-42e2-a862-d96bd2daa5da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360110, "uuid": "bdb39660-71f9-424f-8871-add1978dcb68", "value": "53e831c9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e7f6a7-aed8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620352918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352918, "uuid": "fccf9482-4b6a-4bd9-a4d5-08162f10134e", "comment": "Malware payload (Dridex)", "value": "dfdba0c755cbd9f58f3f1eefe327fde7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352918, "uuid": "90bc3e4d-9915-4e96-8494-529ae0401cb8", "comment": "Malware payload (Dridex)", "value": "606ebc830e7ece5dd21e9f6265a0dd4fa8d64e37cc772af29ffbc2e9cfdc887e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352918, "uuid": "3321953d-7835-4825-8f9b-635f675b91f4", "comment": "Malware payload (Dridex)", "value": "920d87e7328d844a55364d1d61a17cd6faf3b3c9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352918, "uuid": "b399b8ff-3d5d-474a-90df-ebc224987dd6", "comment": "Malware payload (Dridex)", "value": "d9eba4c46208aa0d42ea408057d280c30dafe1523724c6c422b7718c399e474f12c4f20d6a4634e37d995721e2d8f16c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352918, "uuid": "3e58dc88-8d57-459a-b421-7baa05c778ad", "value": "A1F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352918, "uuid": "732aef51-49bd-47f6-9c67-0a840f959f78", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352918, "uuid": "3f061ba2-fc09-41ee-968f-59211a2e2651", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620352918, "uuid": "fb42d621-48ad-438c-849e-1d9e2318eda3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620352918, "uuid": "c5481cb1-9dd5-46c9-a0ed-25a6acb288f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352918, "uuid": "730d7951-8d9d-4710-be39-fbad9c29bc9a", "value": "dfdba0c7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bbb1a5-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403548, "uuid": "fb2230cb-e41f-41a5-b08d-a82012a6f7ac", "comment": "Malware payload (Dridex)", "value": "42ef71549fd3499ecc485136e679cdf5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403548, "uuid": "9204f85e-c6bf-4ecb-a2b5-aac91d674977", "comment": "Malware payload (Dridex)", "value": "60fb9812a45e143118679977b721a9555c4766d07deefc34de12e59baefc94c6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403548, "uuid": "7f38fa5e-558e-489b-9856-de265e6705bb", "comment": "Malware payload (Dridex)", "value": "ff81975fd823c16790cf97a84b8974ef2fcccb21", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403548, "uuid": "55156887-cd96-4025-9e96-476041e452f9", "comment": "Malware payload (Dridex)", "value": "e4ebbfdc515cf6748b08d006498e0aea1d0601c7444f5087a7b41728362660a2ad6891a9504b2bc62848b70d54968b0a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403548, "uuid": "3ceca9ff-2c96-4f3d-99a9-0f94a8bc466e", "value": "67F3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403548, "uuid": "5065690d-cc77-435a-b141-86dad880b8cc", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403548, "uuid": "ea7f4184-ad55-41e7-bb15-55f441550f63", "value": "3072:sBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHSa:YuXLcclWEc2HeSjNjGdeya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403548, "uuid": "c13b51ca-a83b-4f44-8c55-2ddd440dbaeb", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403548, "uuid": "7bb1071c-9a96-40f4-ab93-dca51e68a1df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403548, "uuid": "6dc7a3b8-94b2-48df-b825-ffa738acbf12", "value": "42ef7154_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bea49d6-aec7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620345656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345656, "uuid": "cb4db553-82d5-45ea-977e-0a0a2ebb2ebe", "comment": "Malware payload (Dridex)", "value": "226dbee139a4162e76974bbd70a6a6f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345656, "uuid": "d5af1596-e363-47b7-80d4-fe6272092d50", "comment": "Malware payload (Dridex)", "value": "623c446a119267b48f212b0234af86711d24701dcfe4ddf8ba6bea90201f6932", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345656, "uuid": "7875448a-2c89-4b69-b656-382bc66fd626", "comment": "Malware payload (Dridex)", "value": "9cba83d0399ef19ce415f729ea67693a1daa3c6c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345656, "uuid": "ead5b195-78db-4f55-b1bc-ae3492d9e150", "comment": "Malware payload (Dridex)", "value": "c9162687c4200196cb83c12a8b758eb2a55627aa5dfd889f770b004ec944d31f9cc40ba6431471d7b0eecb4f45628955", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345656, "uuid": "11d4ef8b-de85-4011-bb45-345141b12e48", "value": "B5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345656, "uuid": "62626a41-5ed0-45d6-b5f1-55b31bdba502", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345656, "uuid": "a6da358a-0f87-4884-932c-beda057fd93b", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620345656, "uuid": "da75af41-6f66-45e4-b98c-3b2f98235406", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620345656, "uuid": "d2bda200-5815-426b-8b44-7026b768290f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345656, "uuid": "545adf8b-5d0b-49c7-a637-aa1425e9d591", "value": "226dbee1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50326f61-aef1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620363702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363702, "uuid": "347c8555-f29f-4388-b3bc-ab0069e69860", "comment": "Malware payload (Dridex)", "value": "74bc15025a90c8878c787e7c61dd6903", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363702, "uuid": "708636b2-ab7d-4352-9ef1-deb7f619d002", "comment": "Malware payload (Dridex)", "value": "62641db9a689cda4cde0418a0ccbe280a3ee8bd3f7903aeea35d198100c29d82", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363702, "uuid": "7c8cf545-899c-4ccf-bc29-57ba9310b0aa", "comment": "Malware payload (Dridex)", "value": "0a67148bc063c97a63b7a38affccf1c59845b2ff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363702, "uuid": "f7faed51-cc5f-4898-b238-aeee3da9abc4", "comment": "Malware payload (Dridex)", "value": "8d812468be0aba2751c8628a7a865e39d815bc6694843f33b1ff5ecc182b13f054ac7cd25824b8ca06935cf7d5444256", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363702, "uuid": "d5a5932a-f6c2-46da-b662-8721fab705c1", "value": "59F3C085DBABE8BFC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363702, "uuid": "f08b3429-5c99-4f32-bee6-c0d7999250a0", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363702, "uuid": "3fa54427-b450-45c9-89dd-dcd8d08ad964", "value": "3072:ie45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:P4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620363702, "uuid": "a04fc966-d9fb-489f-b841-46ece4a2b2e6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620363702, "uuid": "b5a5c690-1ea6-4786-ad47-5c01cebff9b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363702, "uuid": "526fdd39-8766-4112-a30d-905f82dabd57", "value": "74bc1502_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7d5482-af02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620370921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370921, "uuid": "bd44f4f5-2639-4ac4-b0ae-53b91020865d", "comment": "Malware payload (Dridex)", "value": "8177677e59c98a7f4451141b78d2d2a5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370921, "uuid": "8ab3fbb6-ab1b-49cc-b71f-00fba9d1c288", "comment": "Malware payload (Dridex)", "value": "62813657ea10d6774ddebb44c1f9518bf5e464fdbe4fe290502fc888096b4e41", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370921, "uuid": "087bc0c1-5b93-4ff3-8f18-c23bbf4e3607", "comment": "Malware payload (Dridex)", "value": "8c841238c5a9191262496fdac7bf43e23c3c4336", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370921, "uuid": "10c8bf7d-c15e-4d07-91c5-1941942df62d", "comment": "Malware payload (Dridex)", "value": "02b4a6dbff3bd0a08eb1af1caa965f0bcc0de200bae65cc41190083171b6695605ab602928baa140413a41c24af4a22b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370921, "uuid": "c92b3ba6-0918-4a96-a622-70c833317a90", "value": "08F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370921, "uuid": "a16ff23a-bc9f-4951-9e35-7c54d56756c6", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370921, "uuid": "20cd5571-2814-470d-8e62-af24063678ee", "value": "3072:8e45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:54KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620370921, "uuid": "12e67235-98ad-4503-9a7c-4d8e7e5dff2e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620370921, "uuid": "220dcb8a-965c-4738-b64a-47132fbfff57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370921, "uuid": "0b1b8c70-ceb6-49ef-b48c-a9fa177550c3", "value": "8177677e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d7c700-af46-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620400131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400131, "uuid": "225cfe00-30e6-4b7d-bc06-a7415d61f4db", "comment": "Malware payload", "value": "5f50adc711f178f3fb2c54944f093c60", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400131, "uuid": "862f0ab7-f14b-4bb2-9120-e3bf6a1d6443", "comment": "Malware payload", "value": "62d287f44c667d6a1a55618c589d2d920107088f9e3195f23a0c93708719f939", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400131, "uuid": "606b4600-a3f0-4956-b55e-61f7c21a2cd0", "comment": "Malware payload", "value": "8995dd261a7d055b65ca56d86422cf223cbe57e5", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400131, "uuid": "5492c069-1e57-4b1d-a213-14f2ca593c11", "comment": "Malware payload", "value": "fee842487f270b458610cd5e7f482479db206bf31eba8e80aba0ad937c006ceff58f91429b043668eda7a31acb433ef1", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400131, "uuid": "30ad91c6-5b5b-4063-bb70-e66058f8d12d", "value": "EB8302288435F4B9DD774A39C1990FAB180B3BBBC1E11405EB72E26C1F45E690E8F6D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400131, "uuid": "da0270b6-c07a-4caf-9af6-1d7b3d2c7606", "value": "1536:UWZzcBHTSWCkkWbHKFTz/dnxlEZL4C+PvC8PCz5IuR2ZH7DuVrBJb5Kxc1:pzQHulkoFTZnwz8Ez5IuK7DuVQxc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620400131, "uuid": "9497b2a4-98cb-4f0d-b790-9d8e27aaa60b", "value": 87521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620400131, "uuid": "d667ae99-efd2-4a1e-88d7-94dac434f974", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400131, "uuid": "10d9dd53-1ff2-4304-9127-b3375e3571e3", "value": "purchase order 370149.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1610488-af65-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620413740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620413740, "uuid": "afa870c3-4e52-4c81-9ae1-e5d587e91538", "comment": "Malware payload (RedLineStealer)", "value": "7eaf6cacffb2ae2b3c3b6c2b0491e2a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620413740, "uuid": "10ee1d36-0932-42f3-a5e5-f023a66dc2fe", "comment": "Malware payload (RedLineStealer)", "value": "6308b2097dcba28565037a65fd9354fe7cecc13df2b7459ef91153760fa8dc42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620413740, "uuid": "c9d72984-515a-4e3d-b1a5-7a734100d7cc", "comment": "Malware payload (RedLineStealer)", "value": "1a51248c75d910c49f184342a912fe9cb7ace5d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620413740, "uuid": "907d5b16-56bc-44d1-943a-375e4cde28da", "comment": "Malware payload (RedLineStealer)", "value": "e452bb4607c16fba37a13c4c7420a485946a8498a6e043ee77f8cb36bb3b1ad87865e156dfb8bf2be986982c30f9b3e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620413740, "uuid": "2fa17945-ba47-457a-ad00-ee3c94814a51", "value": "F8D34A3D3FDC4E12D6AD6B7788C7608463FAADE61643E70B9C8032DC5862FE85406A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620413740, "uuid": "5335d12b-91b6-4cd2-b688-53ce34babb3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620413740, "uuid": "42bbe3b4-74b1-4c04-9a66-d498d181132e", "value": "3072:kfXAgVosyHfzohyQv3wIdCttAha1mUqCUnHh:kfzifzohyQ/wIdCtKg1mpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620413740, "uuid": "41fb09af-f67e-461f-8271-bea0f3e480ef", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620413740, "uuid": "92004bd3-f6dc-4cc7-bbcd-236611f3bdbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620413740, "uuid": "f07be992-58cf-49a5-b6d7-c133bd845fce", "value": "1a51248c75d910c49f184342a912fe9cb7ace5d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfdbdca-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403668, "uuid": "68640849-057c-40a3-8405-14805451b792", "comment": "Malware payload (Dridex)", "value": "f1db0e13f6a740d86a61e8fb50d6f1df", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403668, "uuid": "7b4aea9b-0945-4c39-9408-40710727e443", "comment": "Malware payload (Dridex)", "value": "631dd01069380ee11da27916ecca0333119a6d1d7f9c049894699d49c199c2f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403668, "uuid": "f0c69276-ccce-46e8-b319-7b66a0e462e3", "comment": "Malware payload (Dridex)", "value": "0dd6259245a29ba7a5e387060a410eca9a0ab979", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403668, "uuid": "5ed71cee-203d-42bb-97be-3fca7df9573c", "comment": "Malware payload (Dridex)", "value": "1e954d036266113b4e9e65d645291253a596617d7369d8d97c171aac710e5c3ded0a56b8058605fd8072b836aee78e70", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403668, "uuid": "bdf612de-835b-4b10-b764-388a0593d025", "value": "4EF3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403668, "uuid": "5cd8637f-0b83-4ca4-9bab-77d05c80077f", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403668, "uuid": "bba7061c-0093-4e14-a4fe-3ae9910c6dea", "value": "3072:iBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:iuXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403668, "uuid": "e1e80297-0ce4-44a3-9db4-45abd852cb76", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403668, "uuid": "dc122ccb-e3fa-49bf-84bc-473065f4f878", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403668, "uuid": "ab6db344-78c9-4efe-8803-efee0d32dc0f", "value": "f1db0e13_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc139c5b-aef9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620367372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367372, "uuid": "7e41532b-f3db-4625-b358-b07d80c3da30", "comment": "Malware payload (Dridex)", "value": "830757eb3c1edb4f4b8557dc328db4f3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367372, "uuid": "4e1038ec-5c0a-452b-89c4-773a9fdf2f76", "comment": "Malware payload (Dridex)", "value": "6369df603133bbaeb06077333db34e494cee1fe3648e48c5544f3a55683d9368", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367372, "uuid": "76f74f59-29d8-4d54-8710-103dcd595c16", "comment": "Malware payload (Dridex)", "value": "e459345f97a511890d6c18bda240ca414069cc13", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367372, "uuid": "213abb2e-cc79-4862-9f54-c5513fe37d3f", "comment": "Malware payload (Dridex)", "value": "1021a8c21a6b9941cdea70707c171139555979a607be023e37b848d443db14882ecfbc60b8d5819f8301045fba042ca5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367372, "uuid": "65288fda-6009-417c-ba58-e06facba7619", "value": "20F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367372, "uuid": "c147e018-4dff-4405-81e4-d71ea12fcb50", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367372, "uuid": "e9afae88-962c-4327-ae31-a2f98a3c5e0a", "value": "3072:jWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:j42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620367372, "uuid": "acb0cb6e-a47c-4d08-af3c-d3c2591342b5", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620367372, "uuid": "00698c75-b5f2-4beb-a36b-e6b951ec108f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367372, "uuid": "2d38c78a-1995-411c-ba73-dde70c08355b", "value": "830757eb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a78e6b1-aec7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620345680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345680, "uuid": "ecaca2e8-c52d-4e7f-878d-e7f49f4884dd", "comment": "Malware payload (Dridex)", "value": "f52d4e68208dc13de6288700472d465c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345680, "uuid": "2066bcde-2652-49ba-a76d-bf7579867bd3", "comment": "Malware payload (Dridex)", "value": "63d455dc9a68c9bcf663c81162f94085b2ad6c3a93ae61ba2c54487baa59581f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345680, "uuid": "1d3ec50c-bf55-4e0d-98d7-4e33cb588104", "comment": "Malware payload (Dridex)", "value": "7c17b464fd9b0cfe08c76b92d72359fba75ba102", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345680, "uuid": "6b14e605-b7a8-4a35-8c91-2518e070322f", "comment": "Malware payload (Dridex)", "value": "c2982ca71fb8c9e36c6a6b2bf668ed09fd5658b6951a5f5b4a38a7614d86124d6f97539341fa88fe3b521eb9e0d1c5e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345680, "uuid": "46c798fc-4935-4fd6-b4e9-9a0331c13c39", "value": "74F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345680, "uuid": "bfcc5e0b-74b1-467c-9008-693300d51102", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345680, "uuid": "f0eb5802-f7e2-44c2-9ddc-af7034950cf0", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620345680, "uuid": "da2b7a9a-8fae-4ae1-9deb-f9b56acdf7e5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620345680, "uuid": "d95e5365-6020-480d-afb6-5a4e082e02dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345680, "uuid": "782fdda3-91c4-4e57-8f86-486313611b93", "value": "f52d4e68_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8eaedb-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620385247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385247, "uuid": "c4db9b15-e5cf-4190-a9d9-31f9e6629abb", "comment": "Malware payload (Dridex)", "value": "25f1aa09f52853ef8f0ce09917d04552", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385247, "uuid": "d9062c32-11d0-43b9-ac92-619ce754abbe", "comment": "Malware payload (Dridex)", "value": "641ba22ec2f6c014003cb85d08a62e2582f4801d395b83ef49012da19ba14fce", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385247, "uuid": "0e0609b0-a736-41a9-9ecb-15fd16c31d8d", "comment": "Malware payload (Dridex)", "value": "5af4906d850604f090edc3b7c435bfcc02a454a6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385247, "uuid": "baa5bcb4-b45f-430d-96ef-b3a402c54df4", "comment": "Malware payload (Dridex)", "value": "5a095798e18f31da292aa501c31e530bfcbc343511b269fd1ea9e0cb012454bbf2859e89d91fd1d8cdcee22921ffa1a6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385247, "uuid": "ac61334c-975a-45bf-9f42-23d67847c181", "value": "F4F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385247, "uuid": "542e665e-c554-4881-9472-1b723a49a2ee", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385247, "uuid": "07a749b8-df42-42e8-9f94-ca06d8176a4f", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385247, "uuid": "6fdb3c07-7b7f-4768-bfc8-5d76c1170d81", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385247, "uuid": "c1f15202-10ce-42b0-bf2e-da43f103043e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385247, "uuid": "79057e45-5ee9-40fc-bf45-183cdd22efc0", "value": "25f1aa09_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c32f751-af53-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620405893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620405893, "uuid": "f1e87104-b26f-40ad-8642-e15a7f2cf69c", "comment": "Malware payload (AgentTesla)", "value": "8d0a647e7bcccf36b16840403183b95d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620405893, "uuid": "1237fc20-6229-4589-94fa-9c0fc57a204e", "comment": "Malware payload (AgentTesla)", "value": "6460588f6af7ee7a18cd7acd5c4cb451d9512aa4a14f8d09ee90da44bc82b5a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620405893, "uuid": "0d577353-013d-4fef-b0e9-dc71f766ebb2", "comment": "Malware payload (AgentTesla)", "value": "f0c79392d3c6cafa3c5cac9f63bb76206a59b624", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620405893, "uuid": "69c7ce38-1ef2-4645-afe8-20dbaa451301", "comment": "Malware payload (AgentTesla)", "value": "eab1dd34f6bedcf74a6c178dfa183626990e20809a006587f7a2a4208e51f53476b71cdeb4ba7fe815e6465dbd85d4a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620405893, "uuid": "695d7929-5134-4611-a487-13b1fd4c7f3c", "value": "49E423F1267B2E1D9CAE2DB7CD70F5AD4C4C4B36D9AE27821FEADFA412775081202905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620405893, "uuid": "b08d0c9b-c1e5-460f-92a3-33387e376ba8", "value": "12288:uewrK08Eo+T7Ksm2LxJi3WU3LlyFMBzVQ2MVhjTz0HaqjQ9pnR/rddgaTX2T+XEu:UQEfT7KsbriGKyF1hXzGaqjQLR/rbgaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620405893, "uuid": "cb2d4221-c5ef-48b5-8ffb-449631c6c521", "value": 669333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620405893, "uuid": "a85a6ba1-2b63-44de-8e5a-7e6a56de1d60", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620405893, "uuid": "7721b0fa-be9f-4d20-8144-3c41cee86ac0", "value": "Proforma+Packing list.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8935a103-af0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620374535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374535, "uuid": "89655b82-0e4a-4f85-91f2-c798fd9744bd", "comment": "Malware payload (Dridex)", "value": "1fea1638b583b0e2d7a038ebf7f3aa8b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374535, "uuid": "07f8f0ff-d276-49a3-89bd-1f2436f5ea6c", "comment": "Malware payload (Dridex)", "value": "647d395a9660785ce0effeb251db6689511dff670aa4bd1d77048e9a59d1a39d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374535, "uuid": "b70d177c-5f2e-4da8-bef6-41c8c7079339", "comment": "Malware payload (Dridex)", "value": "854f6ae0fb6242e425724e5ebef3f7e3a33b88bd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374535, "uuid": "06292cf0-c3f1-4d3c-9ff0-f30b986a0401", "comment": "Malware payload (Dridex)", "value": "9941d2930ebfdcfb3100492e88015312639fea92cc78d98faf5641432ee3d178970665fe86961ee2ff8bcbc72c18f922", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374535, "uuid": "e0be5013-d6b1-4296-a0f6-7c9305e68d91", "value": "94F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374535, "uuid": "8349384b-2f75-4f1f-8f2e-c9a712d60a8d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374535, "uuid": "90274310-0905-4374-a1c0-ea41e953ba88", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374535, "uuid": "2fe9912c-ada6-4007-abb8-38835f81f11c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374535, "uuid": "62ce40b3-58d4-464e-aaff-822fd5ca82bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374535, "uuid": "5a7cdafb-497c-4179-9a00-d3804effd02d", "value": "1fea1638_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1355553d-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403972, "uuid": "59d5c68d-9323-403a-b60f-e2145cf91301", "comment": "Malware payload (Dridex)", "value": "d4866ffa03aed2243b91047c7465e175", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403972, "uuid": "d841c207-33ee-4c89-8592-c23e6fe6ea9f", "comment": "Malware payload (Dridex)", "value": "64ac92e6e13836a26cb116c674e080f5573a10b165a5f66e95c46d0520a596e7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403972, "uuid": "b4d0bfbd-029e-4d24-b2d5-50e154d1529d", "comment": "Malware payload (Dridex)", "value": "373544877db40a73e446aa7c894405e761f08929", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403972, "uuid": "04382f95-22d0-4ca4-b5eb-66a28b497ad4", "comment": "Malware payload (Dridex)", "value": "7557b8a3844266dcfc131e2bc33c6cca66f0b81981e90c22080260e22f91e5d68ef00037951f414b5699667ce7855f8b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403972, "uuid": "efbcc292-cbbc-4504-947f-6392cfe70a0b", "value": "26F3D141C9C5CCE0CBF36C3A4795963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403972, "uuid": "1d21b247-ca81-4a79-a8cd-5c13bb75ea7d", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403972, "uuid": "3f1dd99f-3c13-4134-9b1d-2aa8a542c2a4", "value": "3072:TuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+zG:T0czbty9uiaJlyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403972, "uuid": "20e68223-0064-42e8-a875-c17a54100787", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403972, "uuid": "0b33d5b5-3e0f-4ac7-bb34-a2042b70b4a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403972, "uuid": "a86b7544-48fe-4ccb-a48c-7e7b3bcbae98", "value": "d4866ffa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4a80f0-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392231, "uuid": "18841f73-ecca-4109-aac0-a936119ce38c", "comment": "Malware payload", "value": "ff9069828b3d430346265e313fd0ed8f", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392231, "uuid": "de392b2e-2df3-4652-856e-77c1396f573f", "comment": "Malware payload", "value": "64bcb88885008938e0d058d6d2aef2da7f440e004210e43235298515c972a8f5", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392231, "uuid": "34e8ec64-e7a6-4c9c-a3ef-7d3ad0f2dbbe", "comment": "Malware payload", "value": "f307ef34f65d6b23b73cd9a066cf153720e5e8e1", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392231, "uuid": "373fa699-fcf4-4ef9-9b3d-0a0fe63f5e45", "comment": "Malware payload", "value": "fa6f4de9d46c708ea4ed6142ec7667daf5ce8b24306f48b791d1be43b2c8bb69f5e9e36c668eb602ca597018a130de77", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392231, "uuid": "364ac114-90a6-4675-86d0-d0e5940d7279", "value": "CFA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392231, "uuid": "0c4bae5e-79da-4dce-a6a7-9d3efd314eb0", "value": "96:rRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:rRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392231, "uuid": "0aff1138-b3b1-452c-955b-638d633be072", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392231, "uuid": "2a58ac5a-418e-49d8-89ad-20cfe333eaa7", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392231, "uuid": "4a47c867-2453-40c3-b2ea-679587a1442a", "value": "64bcb88885008938e0d058d6d2aef2da7f440e004210e43235298515c972a8f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a13193f-aef4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620365007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620365007, "uuid": "5afefcb4-7715-4ed5-9755-a651ee3de263", "comment": "Malware payload (AgentTesla)", "value": "572ccac64403fc9cd76d53d3dc109789", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620365007, "uuid": "7decd952-911c-4913-a550-9d006c10aea8", "comment": "Malware payload (AgentTesla)", "value": "64d8cfadb5aa988231125b039a59d50c08c63e815087b37f5df86e61c1714b74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620365007, "uuid": "8acf6874-bf90-40fe-92b0-a2bb363fb180", "comment": "Malware payload (AgentTesla)", "value": "e050a25066ca363395a1e0e24421ea8ce5f2ce30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620365007, "uuid": "954500d3-4940-49c2-b1dc-9c2726aeebe3", "comment": "Malware payload (AgentTesla)", "value": "5d1f0920e2895094b6f78683b66d8fdab710caed0f524fe8590aa72cf2407d3645176bacbd37f4107ca5558fd09d3bff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620365007, "uuid": "b87bc808-2354-4ed6-b626-6bc43442ec25", "value": "FAF4E0262386DA66D92A5778D16023F013F1BD11F322DE0BEDE97C9D3976AD043992C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620365007, "uuid": "adc6d94c-4305-44d5-be60-6063291f529b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620365007, "uuid": "847668f3-0b21-46a2-bd64-5620bbed56e6", "value": "12288:oOTzQ3vX1b+Mei0lY2JJeXLQ6A28jJ9CtQhKGFWtbkxYbdIKYM:olvK3lYAHBjTCt+KGKhbd7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620365007, "uuid": "236756f8-8fa9-4d85-ac89-e67bddbab55d", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620365007, "uuid": "95277314-29a1-4ee3-ae23-f74a5f1a8854", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620365007, "uuid": "88a81aa3-8ca6-43e2-9588-5c3458b22250", "value": "PRICE LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740d29de-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403705, "uuid": "8aa950e1-79e1-45c1-b9ca-999f7ad80c71", "comment": "Malware payload (Dridex)", "value": "a0264120fcb254fd0e4ba80fdd2a2afa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403705, "uuid": "296dcdaa-d9f8-46d5-a0d8-33c68e3e311f", "comment": "Malware payload (Dridex)", "value": "65209505353da1d5b22fabc63d1db9003ebd8b11af097ec3134397f0b8a8c63e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403705, "uuid": "7007f410-aeae-4dac-8fba-d9ed5be5b339", "comment": "Malware payload (Dridex)", "value": "63638c0f7ff45ec01da1748bbbbd53bb5fb800a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403705, "uuid": "a982d5c7-2c3b-4b41-bd62-04ba4d825ae9", "comment": "Malware payload (Dridex)", "value": "6d4e9cd2589bf61a3f3d6dfd186940ac49f5194ce1c2543be1c69bd01866016f989d8f6db4081d16e3f959eb7d33cfc2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403705, "uuid": "cedb035d-d25f-43d0-b8b3-a0a656ac8b3b", "value": "7DF3D080E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403705, "uuid": "6896da03-b0ce-4ed3-a7b4-61bdb9b58184", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403705, "uuid": "7a2cce59-d42e-4840-b3b0-a4efdc73b7a6", "value": "3072:aBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHNz:quXLcclWEc2HeSjNjGdetz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403705, "uuid": "3aa8003f-84cf-474d-adaa-2403ddf2d351", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403705, "uuid": "7dcc5989-b114-48ff-aeea-5fde8f7e3758", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403705, "uuid": "64059167-0e86-402c-9435-5b943d0bd1e5", "value": "a0264120_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6f0600-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620392549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392549, "uuid": "6f68a90b-c577-4bd6-a2a7-67df88670e60", "comment": "Malware payload (Dridex)", "value": "53df9c5e2cef719102bd37d802715624", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392549, "uuid": "d7605283-d3e8-4443-a7d9-4b77a36dc883", "comment": "Malware payload (Dridex)", "value": "6524b7bae3e0e38f89149018adbf146811d3a5793aced2b5e6c0aa78dd0274d0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392549, "uuid": "3e383ac2-be32-43e4-a0de-5fce87e3f7dd", "comment": "Malware payload (Dridex)", "value": "e9a05b62f03fa6601175af2b5c5a13ca6a490e0d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392549, "uuid": "0da58f6c-c4de-4610-80dc-a279686462d1", "comment": "Malware payload (Dridex)", "value": "679fbcab876889f69eb93efa1e5740538839ecdb94b36865a9d908d8665da28464fbf35da06fbf56235201129619e602", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392549, "uuid": "c5a241ce-06ce-4f77-b6f6-3079f5da40ea", "value": "2AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392549, "uuid": "34901675-4162-4f1b-8db8-02efca114895", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392549, "uuid": "9ce3e342-228c-4dab-9c4b-c7d791f6c674", "value": "3072:mlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:mlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392549, "uuid": "5dcd58d9-e7f0-4e92-928b-48c2ca2726aa", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392549, "uuid": "2837b3c1-eb86-4c17-b90f-0e065bdc27ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392549, "uuid": "238e9a11-3d95-4fa3-a0f8-00e04a253c33", "value": "53df9c5e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05566c2-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403484, "uuid": "2bfd7605-3975-4b92-bb41-99d0e1c45fcc", "comment": "Malware payload (Dridex)", "value": "96a178b863f924a6585af161a38d1ff3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403484, "uuid": "07aa942b-fd5c-4462-82c3-b3e903d2d7c9", "comment": "Malware payload (Dridex)", "value": "653247bf56e3cce02782a053da57005e33f6cacab124547d10fd6a757bbf2648", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403484, "uuid": "0408127b-a0f4-4b88-9456-c2ad215f2d2f", "comment": "Malware payload (Dridex)", "value": "5025ff7c26701dc40d9d3f9a50f0763459a84f41", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403484, "uuid": "e7400b8e-ec10-4f8d-bd15-567e09fb70f8", "comment": "Malware payload (Dridex)", "value": "d5832e1982f3346e9d0a1b9799759d647a8e533ef5997cbe4654b25313851b0d6259e1ffd9f7e9e02249c8fc375aa87c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403484, "uuid": "1170731e-5eb0-499a-9928-0bbdfc26f74e", "value": "09F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403484, "uuid": "b0ac2c3a-29e2-4b32-a85c-14fe41315a45", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403484, "uuid": "21b48149-a9cf-4d69-9497-c6b43e71da3a", "value": "3072:uBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjf:WuXLcclWEc2HeSjNjGdeDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403484, "uuid": "fd5aaa0b-b909-447f-bde7-952527a58aaa", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403484, "uuid": "62fb2f08-4e47-4346-aff5-76dfcec2cadd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403484, "uuid": "ac68217b-a12c-4e63-8847-983c83c6fb0a", "value": "96a178b8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71977a3-aee8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620360062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360062, "uuid": "7223ad3d-a7f8-4718-bc1a-859380d36c6c", "comment": "Malware payload (Dridex)", "value": "7918be07dcd0bafdae21da1d68e9bfea", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360062, "uuid": "a57946db-b874-4e27-8922-77bf1e2fcbe0", "comment": "Malware payload (Dridex)", "value": "6544a6a502ceaff56b85b0223484d56da5724f70dfe6c418884d3e41959adae1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360062, "uuid": "101fd037-8297-449d-83f7-067efd7f2139", "comment": "Malware payload (Dridex)", "value": "91d0c03ab9e6d10e992252cbb7fb1150383d584e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360062, "uuid": "97c2ec94-35bb-4ed6-8c63-361b13264e30", "comment": "Malware payload (Dridex)", "value": "11786c18cdfedca97c3a2717471b952fdb81d597f4a46f34ce7340f2cc722c24313de2f17fddf7a53e79fc278eb038ab", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360062, "uuid": "f41bcb9c-658e-4bdf-931e-3018cf67a239", "value": "8DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360062, "uuid": "4dc0a915-d995-4945-8631-301bbe1f897f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360062, "uuid": "6a50d5b0-e29d-4119-b296-fe72f25a0568", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620360062, "uuid": "367d0bec-7fc9-474a-8a6b-4d872454ada2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620360062, "uuid": "b3700ee0-a40a-44b0-b0b0-9a5c9f0da3e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360062, "uuid": "145c6cfd-2540-4604-90a3-5167810fc3f7", "value": "7918be07_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d63ddb3-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404016, "uuid": "eae51222-0722-4da5-86c9-3af2ce725183", "comment": "Malware payload (Dridex)", "value": "ac4c132d55b7ba129733509d71c8f1fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404016, "uuid": "fd9db10f-6f33-453d-be2b-7c450b97f806", "comment": "Malware payload (Dridex)", "value": "6561cba6649a4019a286c9e5f48883718f5a0105693e13acf2129a8d7514bb43", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404016, "uuid": "b3b9d8b3-c163-4a6f-b1f4-913bb0383f0a", "comment": "Malware payload (Dridex)", "value": "78699b64a5490bdc163944015ec86d9c3b35d187", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404016, "uuid": "3e671294-3572-4c2b-a610-7dc563179cd7", "comment": "Malware payload (Dridex)", "value": "1f97f6c5d24602ea625ceae23cc745a1d744ea57ee76bbda508a56550623f62bd371922032d767517aef1f4f1934bec7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404016, "uuid": "6e592868-8947-4500-820f-a2e1e909f7e5", "value": "0CF3C141C9C5CCF0CBE36C3A4695963B3728B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404016, "uuid": "626b55f8-e95d-4472-8567-ade52be5eb16", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404016, "uuid": "5841c830-14fb-4cdf-b0ab-1b94bf7affac", "value": "3072:CuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+zN:C0czbty9uiaJlGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404016, "uuid": "fe71b78b-3068-498e-8995-5d4ef9b89cc0", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404016, "uuid": "0674ed76-ca3a-4c5e-807c-eba9e1d61d09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404016, "uuid": "06e3245e-d3e5-40cc-ad94-94d156db8c29", "value": "ac4c132d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9b8276-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620392630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392630, "uuid": "10aa4bac-10c6-4ef2-ad0e-d842ad8fdabe", "comment": "Malware payload (Dridex)", "value": "5b38b3a0596d029f1b1f79413c966534", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392630, "uuid": "8aab85ff-ea7e-4f89-ae90-c8311ac52ad8", "comment": "Malware payload (Dridex)", "value": "657962e0c3ffc4d14c4f694a600ffb416a94fcc906cb398de565dafb4090b0b7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392630, "uuid": "ee08b7f1-67dc-4bf3-9f7a-dd0e189b4be5", "comment": "Malware payload (Dridex)", "value": "d5b241b2fd2d8b4eaeb3022a2869fa50ff3b1dac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392630, "uuid": "5a57ebce-a81a-438d-9942-a0dc741f137c", "comment": "Malware payload (Dridex)", "value": "021b48c0d5f999e7585edd5238fcb76f9392b1bca25c2c9be3f0a12ae8fffedfd1affa9546c71f9fd3a618a2b7409573", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392630, "uuid": "f65f0533-2cba-4ee2-9cff-8aa23212235d", "value": "6EF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392630, "uuid": "c7f7e8a1-afb8-4beb-a322-b15852ee30be", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392630, "uuid": "10f15656-e07a-4177-8667-e9d7056030d6", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392630, "uuid": "68383f44-cbf3-42b9-8ca7-1c74e973c217", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392630, "uuid": "541711dc-629c-45a6-8edf-adcac3a104d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392630, "uuid": "ec9f2858-6f3e-481b-8c96-c9d6e802e03d", "value": "5b38b3a0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a4834d-af1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620381751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381751, "uuid": "34f8b809-6198-419b-b120-92013439f1c6", "comment": "Malware payload (Dridex)", "value": "2ad7f773b3edf18007994fa0849529d8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381751, "uuid": "2f0387a8-1d3b-41d9-8344-b10eff447dda", "comment": "Malware payload (Dridex)", "value": "658579485647dc01fb72b72646cc2ca955bc42962fc6192bad426fd8f6b312d9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381751, "uuid": "abe58a97-f500-4cd2-8c44-ea5932a5544e", "comment": "Malware payload (Dridex)", "value": "7f275fc5421e1f70a92f91fe7a6958b96b2c8c03", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381751, "uuid": "14869393-088d-4a3e-b316-2c71a5ba7781", "comment": "Malware payload (Dridex)", "value": "c196de3e916121ea86f645d08ae5612be315ecd6aef871e7947c5c31f5aa2af6d65e628a76f0217756900e4d2a39664b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381751, "uuid": "2561285a-c37f-4440-bdc1-29cd50bc2784", "value": "F9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381751, "uuid": "17a4e48e-6072-49b6-ba64-4e0714cf8163", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381751, "uuid": "d4fac187-1a29-4a65-9c78-a5f3e0918952", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381751, "uuid": "6cd0085f-3bbb-44be-863c-f8379aeffd72", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381751, "uuid": "b42b082b-4acd-4869-995f-21ee687704f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381751, "uuid": "bc5bd627-51f2-495f-85d1-9b797d9ed346", "value": "2ad7f773_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a827759c-aef9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620367285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367285, "uuid": "bfa72a5c-fe83-465b-b3f3-17fa3afcaac0", "comment": "Malware payload (Dridex)", "value": "129fea17b217531a3e7c2d947f15dbc2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367285, "uuid": "ec857d5f-01e2-447c-bf5a-3890e77570fb", "comment": "Malware payload (Dridex)", "value": "65956c00f53afac0095e9167ac2680b921ca3bcc4289ec08401bf52024ae28bf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367285, "uuid": "35b985e8-c588-4504-9ddc-2d269ded9683", "comment": "Malware payload (Dridex)", "value": "fccb5fd991e53774014563b8f774c5d050020c3b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367285, "uuid": "4d981181-cdd0-43e1-a17b-bbcd4780af2d", "comment": "Malware payload (Dridex)", "value": "4d9b6ddbea68d4db99b8e73afdfc0f6d8a3cebd1486e2012740b17c12c184ac142236d18b2023ca210563cac3697262a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367285, "uuid": "b9d54477-0c24-4a51-8e76-c152b692e603", "value": "7AF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367285, "uuid": "0cab699d-a5f1-481c-ab8b-4798db6d9dc6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367285, "uuid": "f28f38d7-ece5-4a8f-b2ba-66ecad73754a", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620367285, "uuid": "e99636c2-d920-4086-a185-4442081cfd6e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620367285, "uuid": "ce6eea09-0010-4b21-8eb0-3e9e175d0188", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367285, "uuid": "0b8df116-4102-46db-9ddd-7d4ea707d5e5", "value": "129fea17_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a975f64-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620392495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392495, "uuid": "efa788c2-9057-499c-9c81-c23c5c8d9583", "comment": "Malware payload (Dridex)", "value": "0a2c06708dc547e4f096699d806c8c45", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392495, "uuid": "5cf8270f-c58f-4fa0-bc8f-f7b53e6c9ea9", "comment": "Malware payload (Dridex)", "value": "65a7874a677956cd90ce103a529c4c118a27b605650654f9cab5b620fe12d7be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392495, "uuid": "23b45740-a426-479b-92d0-119fb479bbdf", "comment": "Malware payload (Dridex)", "value": "b433d3275ae1bd3d3ef15180ea179f65e3dd07c5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392495, "uuid": "1109ac72-3662-42fa-b9e3-74293cfe7fec", "comment": "Malware payload (Dridex)", "value": "feffd1762268f8eeef188c8f7ab23867e67baa4166132667d8e49fd5624f4072643906bbd527191d82db899872a2ecc9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392495, "uuid": "d02f95f3-a5de-47d7-ac03-a00b8b7774b7", "value": "7DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392495, "uuid": "d6c0e933-476e-44bb-aec8-a32b5db7ceb8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392495, "uuid": "776d60e0-d19a-4cd8-ac05-3383157db3ff", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392495, "uuid": "ff332e31-b0f9-4d7f-89ab-523e10d2838a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392495, "uuid": "6f394406-5990-4eae-ac25-ca9351075abf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392495, "uuid": "77a014e4-f4d7-4dfe-b72c-dbe5dfba84ae", "value": "0a2c0670_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97233a96-aee2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1620357378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620357378, "uuid": "32574567-7ccd-4611-9ec3-41fa67ddc6ac", "comment": "Malware payload (AZORult)", "value": "94ce2072f26b297010ef19f3213a3075", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620357378, "uuid": "989008ef-e3ef-4dc7-b93f-54bc4ad3417d", "comment": "Malware payload (AZORult)", "value": "6679e9f9fb5b166c8480c9e741ec9f7b68ac782861c9bbba7685d11ca7328149", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620357378, "uuid": "1ae82436-ae72-411d-9022-c6c265818677", "comment": "Malware payload (AZORult)", "value": "0c86f893bf6517b41ba66dbb5c215cc9b747eba2", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620357378, "uuid": "d00bbd6b-3f7d-4d7b-a305-8de3912cb6ec", "comment": "Malware payload (AZORult)", "value": "0b45e877fc07a52fdf97e6b86d2f9abf32746fc98ced90852368519f5c597e2dbc28e9be0a11daa91a66cbc145a8c63e", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620357378, "uuid": "6f67b50d-2663-4624-8e8e-27a3980ffafe", "value": "AA44BF7AF7C19632D02849B8CD4AD2B5912D76302D3914B6F2DA4F9CD1FA6C16A2C3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620357378, "uuid": "f3fe1652-827e-4bbf-a379-1b1ed739cfcb", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620357378, "uuid": "d0bf3400-75c9-4825-aa9b-66f0299629f5", "value": "6144:Zzx7ZApszolIo7lf/ipT/o84UmbDJifGilnoi4RZ42OXZ1yC:Fx7Rkx7lCJ1TEAZB4RZ422ZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620357378, "uuid": "cfcaa899-b399-498a-9e11-506de404223b", "value": 268930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620357378, "uuid": "fe41c9e1-ab20-4547-afc2-bf03417d9895", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620357378, "uuid": "046d6445-913a-4748-86b6-3436ab9a9083", "value": "94ce2072f26b297010ef19f3213a3075.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6123538d-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407109, "uuid": "011df395-a935-4e79-bfa4-85da8e90665e", "comment": "Malware payload (Dridex)", "value": "c57dffc17745afb76a199c6af2c47a72", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407109, "uuid": "e4fa39e3-7c8f-4d17-a675-b5018305ca93", "comment": "Malware payload (Dridex)", "value": "66851d92cf8592813629e372eb52a3b86fdfd7b557a4b9d750ccce8d53f83d9d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407109, "uuid": "0e845cea-2598-49f6-9afd-c3b8ea48c61f", "comment": "Malware payload (Dridex)", "value": "5f8634e21ab379ed06cc794797cea931adaf800e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407109, "uuid": "5da7ba47-c5ef-4300-ac23-5136e1364901", "comment": "Malware payload (Dridex)", "value": "9a14405894848a06c410368d9b24286a17ac1991c2e499bd9b0e2308951aaf93a86a83bb08788df4f499a97b8937053c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407109, "uuid": "19a1ff81-3a4d-40f1-ac43-4ee7387dce93", "value": "15F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABD96BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407109, "uuid": "1ba54504-24ec-4018-a0d3-30d2009987a6", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407109, "uuid": "be3c01ba-2959-4fe4-a038-7d85676b4a0f", "value": "3072:+BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHit:GuXLcclWEc2HeSjNjGdeCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407109, "uuid": "18a5d82c-dcba-4e8f-a680-70527fbbd6e2", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407109, "uuid": "64167e83-7ef6-4bec-b908-eb46f8f86777", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407109, "uuid": "8d5bdffe-5a85-4e1a-b30d-1d46eff77ac6", "value": "c57dffc1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be189464-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392233, "uuid": "35fef506-c83b-4f00-9018-8bb460d2ac73", "comment": "Malware payload", "value": "fc5a4500cba14f964025290ef42615ae", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392233, "uuid": "b7f6dfb0-d708-4af7-97db-2da35d31f27f", "comment": "Malware payload", "value": "66a97897c8c5df537cbd94525349098efcdc8fcdc466889970506f5dd49f9c7b", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392233, "uuid": "d27d1eb5-1008-49d9-8796-4b646e13390a", "comment": "Malware payload", "value": "b66ae038523255035c7002a211813988b8606654", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392233, "uuid": "9e65f33d-4ef3-4df4-bb38-6764136f2840", "comment": "Malware payload", "value": "15be07cd8bd9870ca5a45f9a20458a0c8838493804626b375bf401d30784c10f1120ad5cc424fa0481dcfc15d339e5ad", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392233, "uuid": "a19d6c5c-716f-4cd0-937c-2eb6af0256c3", "value": "ABA1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392233, "uuid": "aa141e74-f4f8-4490-931f-33d413585f79", "value": "96:sRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:sRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392233, "uuid": "f5940d23-eca1-4acb-a2b3-7902d887bc28", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392233, "uuid": "e5fd8bd4-3b9c-4fc8-b415-8ba284a4d213", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392233, "uuid": "75f63a00-f885-462b-beb3-c35378bfda88", "value": "66a97897c8c5df537cbd94525349098efcdc8fcdc466889970506f5dd49f9c7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a9db51-aeec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620361677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620361677, "uuid": "3d17353f-d634-4dbd-b6a7-8a7803982e70", "comment": "Malware payload", "value": "47f2d06713dad556f535e523b777c682", "object_relation": "md5", "Tag": [ { "name": "#Earthworm", "colour": "#11B268", "exportable": true, "hide_tag": false }, { "name": "#HackTool", "colour": "#80025E", "exportable": true, "hide_tag": false }, { "name": "#Termite", "colour": "#B0C18C", "exportable": true, "hide_tag": false }, { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620361677, "uuid": "7287be90-2e17-4bf8-9fee-c9980a447b61", "comment": "Malware payload", "value": "66b5f6e40fa32c438255612452c0786dacf54ea1b60dfb5f52e9f4c2f307b478", "object_relation": "sha256", "Tag": [ { "name": "#Earthworm", "colour": "#11B268", "exportable": true, "hide_tag": false }, { "name": "#HackTool", "colour": "#80025E", "exportable": true, "hide_tag": false }, { "name": "#Termite", "colour": "#B0C18C", "exportable": true, "hide_tag": false }, { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620361677, "uuid": "29fb7da8-c971-4c5f-ade2-7dbf14a7b706", "comment": "Malware payload", "value": "37b8d9ef8cf26eb7c893a7861f55dab02b008475", "object_relation": "sha1", "Tag": [ { "name": "#Earthworm", "colour": "#11B268", "exportable": true, "hide_tag": false }, { "name": "#HackTool", "colour": "#80025E", "exportable": true, "hide_tag": false }, { "name": "#Termite", "colour": "#B0C18C", "exportable": true, "hide_tag": false }, { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620361677, "uuid": "fd79b961-219f-4e29-a147-e2352fcf5e33", "comment": "Malware payload", "value": "5c4cba3953150d94a899e67e3ddaf9f61bd458364e64dd5463c1f7b9a6ccca3d30798b76df196a78059a488daf1365ad", "object_relation": "sha3-384", "Tag": [ { "name": "#Earthworm", "colour": "#11B268", "exportable": true, "hide_tag": false }, { "name": "#HackTool", "colour": "#80025E", "exportable": true, "hide_tag": false }, { "name": "#Termite", "colour": "#B0C18C", "exportable": true, "hide_tag": false }, { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620361677, "uuid": "798b3557-045f-4525-ae23-d5b2a6d3e9de", "value": "BAB2E047F9450EA3D02BA8BEAB90F46B60732C8587B093A5418E25778FBF68C556821D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620361677, "uuid": "9af778d3-27bc-4046-bbcc-6c3c94fdbe9a", "value": "34448f797c09745539f068cf40f7bd59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620361677, "uuid": "b8dd0b5f-31ae-4833-8e7f-1990b4fb64ab", "value": "384:NAqZc43HkZjik2nbdmGImc8/a/RsYV8CC1YMrBBE4RCLNZmIFLo9jGrM:5Zb3EZjir7+/ECEK4RSG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620361677, "uuid": "5a38db8d-a035-46a5-93f7-699a1d73b937", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620361677, "uuid": "38d9644a-5202-4805-b16b-42abb4964374", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620361677, "uuid": "705bb2ff-a61d-41d3-9e97-f4a645e229ca", "value": "#HackTool #Earthworm #Termite.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1b5e0f-aef9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620367377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367377, "uuid": "9d113fdf-4dad-421a-ac4d-03b38253ba07", "comment": "Malware payload (Dridex)", "value": "6b7d1067bbc18cae5145b06904512d4a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367377, "uuid": "14d8bb46-2369-4021-8be6-9a0b2c83f4ce", "comment": "Malware payload (Dridex)", "value": "66d7fd025f662da3e5e80194ae271f23865f7904c8ae1ebe62df896193280455", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367377, "uuid": "62f6e66f-4d63-46fb-a9d6-d5ee58c291f0", "comment": "Malware payload (Dridex)", "value": "11e4d89b63984fd8e71347b203bdc036409ff01a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367377, "uuid": "5b5786e6-966e-418a-80e0-c4240c5d26f5", "comment": "Malware payload (Dridex)", "value": "ab137e3af59289a4ac3d93656c63f221b6dd8c73042431aede747d0a4a2b139c052242aea8477f1a8b433d61f684ae92", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367377, "uuid": "00ab10de-ac6e-46c4-a7a5-1859e309a47e", "value": "95F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367377, "uuid": "de179824-fa2b-4c51-b748-eb6f090b6a33", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367377, "uuid": "78bb0f11-de02-42cb-a43e-6f4254929641", "value": "3072:TA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:T3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620367377, "uuid": "452a981b-e562-4eff-a2aa-02de50bc364f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620367377, "uuid": "598c9719-aa86-49ed-ada8-f469fcbc2102", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367377, "uuid": "f0e90ee3-f488-4c36-a07f-b9a5b2ec6e67", "value": "6b7d1067_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfe9041-aef9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620367345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367345, "uuid": "dc47fdf0-e4c5-457e-99e2-7d8729497983", "comment": "Malware payload (Dridex)", "value": "4bd1b61a35d5fefd38d0de297bf1b9f2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367345, "uuid": "c57451ba-6592-449f-b22d-7468ff4adc59", "comment": "Malware payload (Dridex)", "value": "6710b8b5fc997821439322da06a4edb7a3a577a4389e828a559b3c12b86abe40", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367345, "uuid": "d8577c0b-4162-47aa-a664-53ac70acad4c", "comment": "Malware payload (Dridex)", "value": "9f9716f9aa028b6f1cf345d022b0ea1556831057", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367345, "uuid": "115c09fc-59db-4fda-9954-0945a7e1f6f8", "comment": "Malware payload (Dridex)", "value": "7f0e3bf4d83b7f9fe89627eb57ada3e4251c815ce64ca0b62a1a77493b654e4a5aa0bc3f896d90569d547ccd960204c3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367345, "uuid": "15fac9d4-9454-4004-95cb-4516ab995c99", "value": "27F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367345, "uuid": "1575adec-26da-4140-8eea-0fdae513aa5c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367345, "uuid": "98647c2e-5122-4f00-a94d-10afa8231b15", "value": "3072:plpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:plo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620367345, "uuid": "5b721f89-dc01-4621-ab30-899bbc692a31", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620367345, "uuid": "8704b36b-ef4c-4e8f-88fc-d78ea0c40e25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367345, "uuid": "dcb37e5e-101a-4fe0-801b-3a9b21b6a68c", "value": "4bd1b61a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da70a67e-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407313, "uuid": "a0240abc-966c-48ae-8942-b74395c9be6f", "comment": "Malware payload (Dridex)", "value": "ec99115d4237000245d3221740307e82", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407313, "uuid": "426442e8-f1af-4d33-b77e-893f976c725c", "comment": "Malware payload (Dridex)", "value": "671f49947662b3b0cf77cfa2bd32b68491db6a33a33e756186397c8dc2bc2fe9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407313, "uuid": "ab4478d7-bbcc-4ba7-a738-5b1e654f9c36", "comment": "Malware payload (Dridex)", "value": "25d4df9b82befb02e25ba71bf787b89c373f3fd1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407313, "uuid": "66d50016-e691-4563-b9b9-7ec13a968312", "comment": "Malware payload (Dridex)", "value": "c2f8013be42455eafbcf62591fdd3286ccc4f4207cf326d08885e3047a9890bc4f09d517999f42a4f317d5ace3cfe45d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407313, "uuid": "244d40b7-ef7b-45f3-9f03-b43cde49413f", "value": "55F3D081E78ED5E0FC179B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407313, "uuid": "c6758704-713d-4ef0-9b98-9685668aff37", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407313, "uuid": "e1eac970-6c9a-4f28-9f7c-94e36eedace7", "value": "3072:QBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjf:kuXLcclWEc2HeSjNjGdeDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407313, "uuid": "6e988002-095c-4dac-8aea-5bcdb85a69e6", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407313, "uuid": "f1dd2548-10d7-4157-885a-b7f71f9b2e63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407313, "uuid": "81727f3a-7932-403f-b22a-f7db4b32f29f", "value": "ec99115d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0dca82-aef2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620364364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364364, "uuid": "adcb363e-f15c-4b03-8986-61f11d941fb9", "comment": "Malware payload (AgentTesla)", "value": "a7abd2226a16aaa38f30ef70017c55c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364364, "uuid": "f5839063-1b3b-4928-8b40-d4be836c9e05", "comment": "Malware payload (AgentTesla)", "value": "6733ad71b1efaa05a8b38003fa18b5ba5a8bab8a04b31d1dfe461619791a8b7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364364, "uuid": "486cdbd6-08ae-4df6-8147-ad725fff2b0d", "comment": "Malware payload (AgentTesla)", "value": "ac997bd76735b7ea41daeb330057ef6c3f7de1a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364364, "uuid": "fdcd6be0-6c08-4ed5-984c-0ee760a332cf", "comment": "Malware payload (AgentTesla)", "value": "576eca2c4561acd33ddbf8285540fa2d58386bde0ab4f3862f2d2348814fd61f4ca129ff1acdafbfcd4a232d025ddbc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364364, "uuid": "672ab059-e059-4030-83dd-dc2eb071b75c", "value": "A00533D447030916F56AF17BF213636B632DA0A35DDA0A12A6608D3D9DBEEC0F7E0758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364364, "uuid": "e8dcb11f-3e67-4ef4-81a4-115f02f6d201", "value": "24576:LacKocSAc6oTAvrUAKC2szVTkHV8irlYy:HKocSd6oToiBMVTGKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364364, "uuid": "a62e30de-cbf7-4dcf-a49f-0b061cf66f4b", "value": 840512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364364, "uuid": "e6313e06-7788-4483-b858-d45959f9c2dd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364364, "uuid": "04ade1fc-e46b-459a-b0e7-caa923bb87d1", "value": "Swift Copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acec9c23-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620392633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392633, "uuid": "2cc96982-39a1-4565-a776-27fa39ac2653", "comment": "Malware payload (Dridex)", "value": "fcc2357204af53ba1611b9ec2c26d924", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392633, "uuid": "1c505b4d-4a7c-4147-b216-7816075fe41a", "comment": "Malware payload (Dridex)", "value": "6738a9a3882f9f3edc184cbb5876678a49d9ab6e1d3daf94fdf0b1d54d76bedf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392633, "uuid": "4b08df30-560f-4820-805d-a3f1cb0bb1ba", "comment": "Malware payload (Dridex)", "value": "f4c222f55207cfa91aef09c1297d0cc5be0e5a74", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392633, "uuid": "5c7e0b10-0781-47a8-b87d-64a9ed9304a0", "comment": "Malware payload (Dridex)", "value": "7a0cc4f53e608875ee519fd639cad21a80ade0cab43d7e12a5e3500a1b3b64c1c2cd5ea874e3b41da99a10ba74d8e684", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392633, "uuid": "abc77e2f-aee5-4592-b0db-098c0b3e48e8", "value": "5AF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392633, "uuid": "e28ab584-43e2-431f-9f49-f14c7281befa", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392633, "uuid": "84ef458b-684b-4fc1-982a-f1d099b4e551", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392633, "uuid": "66678082-1870-4c3e-9993-8c94d7730fcb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392633, "uuid": "5e3f72ae-2b58-423c-9372-d1f9d7283e8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392633, "uuid": "67d9228a-037c-4fde-928d-39c7ab196ae0", "value": "fcc23572_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2e04fa-aef1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620363695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363695, "uuid": "048d0011-3049-47ce-b04f-4b47dbb2ceed", "comment": "Malware payload (Dridex)", "value": "fcd4961ef0ff7f068e6fb9926d83a611", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363695, "uuid": "358b2951-b4bc-44b7-9655-125369879682", "comment": "Malware payload (Dridex)", "value": "6747db1a9d52871e1445fc197ca874a1a7a828f29b07cb99cdbec6dff7694bb3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363695, "uuid": "b1103320-32da-4678-87aa-696bdd8cc1c4", "comment": "Malware payload (Dridex)", "value": "ed08f693a0d3442c394c7e6c911eba82c7937726", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363695, "uuid": "ea60ab60-ec78-4d9b-ad61-dc2ce055df03", "comment": "Malware payload (Dridex)", "value": "739a8157b03e3c8d6e271136bbf48cd165d0884db1cc64f47ed687391432ed00d314184ac38f53bc2f90cd174ca426f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363695, "uuid": "4baf0636-9f22-4b68-baaf-85b8ae56424c", "value": "66F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363695, "uuid": "df27450d-fde4-4980-86a0-24fef8319e7f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363695, "uuid": "dc032b28-4dc6-46ce-be2c-9aae04b48a53", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620363695, "uuid": "de6a7749-9cf2-4bc0-9d26-06e6babdb576", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620363695, "uuid": "6ba480b9-5093-427f-a35e-c3cfb0c05337", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363695, "uuid": "94ea4716-fd2b-4989-b141-77c38612e175", "value": "fcd4961e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b1590d-af04-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620371816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620371816, "uuid": "d60e6e2f-04ce-4331-89f5-c285461aed33", "comment": "Malware payload", "value": "eac0e57a22936d4c777aa121f799fee6", "object_relation": "md5", "Tag": [ { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false }, { "name": "Utility embedded DE3FB65461EE8A68A3C7D490CDAC296D", "colour": "#9C5295", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620371816, "uuid": "0be9f9c4-296b-486d-a578-c7906a712c70", "comment": "Malware payload", "value": "679de007f4c6e92199d31bfa213055bad812c26e537ab183706cb80cce951e4b", "object_relation": "sha256", "Tag": [ { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false }, { "name": "Utility embedded DE3FB65461EE8A68A3C7D490CDAC296D", "colour": "#9C5295", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620371816, "uuid": "5889e832-497a-4efb-a456-6aee4665c76b", "comment": "Malware payload", "value": "312ee1c847610a73cd8438d429b417c5365fac3b", "object_relation": "sha1", "Tag": [ { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false }, { "name": "Utility embedded DE3FB65461EE8A68A3C7D490CDAC296D", "colour": "#9C5295", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620371816, "uuid": "f2d69399-9948-4cea-849b-69e7afc33f29", "comment": "Malware payload", "value": "f929dc0dcd492b1cc1b1b71be801ba15d3d7e93dd4c4b56bc9181a0fcc129914ead26f9351fd75123a9ed7ed4e2d6874", "object_relation": "sha3-384", "Tag": [ { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false }, { "name": "Utility embedded DE3FB65461EE8A68A3C7D490CDAC296D", "colour": "#9C5295", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620371816, "uuid": "1cee7f40-39a6-4a9f-8112-b5ecf7856271", "value": "B8536B127691C832E06215740879D3B25F7EB93316B988837B941BBE5F713C1AE39397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620371816, "uuid": "57ce9776-ab65-456d-bbfa-a53fda7409fb", "value": "5ab4fb36d62ca79df6c4a8a6a4cbd003", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620371816, "uuid": "2ffbee8f-85a1-4fd5-be21-601fbe692357", "value": "1536:jsfZJEDvtFpooKRPJDkifNtxjFublBNG6Z8vPApa:jyDEz+tf9FuNZuApa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620371816, "uuid": "d38d3540-a725-44b6-9315-cbea05959603", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620371816, "uuid": "50ea7a75-27af-4b9e-b344-b5c3cc9f1a6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620371816, "uuid": "90f3911a-f1da-4acd-8591-efedb2f0d5a4", "value": "679de007f4c6e92199d31bfa213055bad812c26e537ab183706cb80cce951e4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbad571-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner)", "timestamp": 1620392125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392125, "uuid": "cc1f3ce1-13ee-4bf0-9f50-6f9c851c372d", "comment": "Malware payload (CoinMiner)", "value": "e00c93a8d92089c7c76fbe9494756767", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392125, "uuid": "9fe24126-a0cb-42f0-9696-bc321bff1717", "comment": "Malware payload (CoinMiner)", "value": "67c1bf436244ca2a7be46383189af959086e7f77f6b325f99a0960d745348b10", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392125, "uuid": "523cb869-f33e-4c80-9b60-bbe423e6efc9", "comment": "Malware payload (CoinMiner)", "value": "e019b100708504bb10225d3e5ab217a4c6e6a07b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392125, "uuid": "74f5a765-77be-4950-a168-1532f7e30e7f", "comment": "Malware payload (CoinMiner)", "value": "cc58a5c22c5a25507de717f6711dac46031b55f62adc56afe9fa374b9f85aeae1191fc66dc12d9cb6f85938645c72b23", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392125, "uuid": "094c67cc-4fd6-4d70-930d-a1ae80cade05", "value": "C1422A5ABBEC8132D5FF0A3658B357000B35E5A58D13DF6F64ADC11A8DB33860722BA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392125, "uuid": "7b388186-b843-4176-b75a-e338307d5f15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392125, "uuid": "b18b058a-3ef4-4e96-a189-3a70afe84524", "value": "384:cXAfv+x17Z/JtLMcLV0tPuLgL/Sy4JN6N1a:cw3+xLRRMwgqk/GNA1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392125, "uuid": "44b04e16-f3bd-4505-95bf-2fe9ba0c9abc", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392125, "uuid": "4d44a62f-01b4-4380-81a8-7b7ab21cb1cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392125, "uuid": "4b119513-8b3b-486c-8e2a-270216e7bc93", "value": "4.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7cd1b56-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407308, "uuid": "7878c345-b4a0-4f13-be3f-c1aef7013b24", "comment": "Malware payload (Dridex)", "value": "032038ea3641c5f2be64e3a2ed80e57f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407308, "uuid": "6b780c53-c75c-4b55-aac4-c4683587d725", "comment": "Malware payload (Dridex)", "value": "67d0ddea74124a9a46d5597b904650ee7073595cb0df7aaf6d050443b394c507", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407308, "uuid": "1a31befa-604f-40b8-9d0d-323b287b59c6", "comment": "Malware payload (Dridex)", "value": "277aeccc4297b72644597481cf4f9e377f0a74a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407308, "uuid": "d0f25086-09ab-4204-86b2-d72b793804a0", "comment": "Malware payload (Dridex)", "value": "98af8249269ab64118a635a07c891489fcd69e80625613e85353773691088f0790cdbe17c7db805641e1dfac74a1ae49", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407308, "uuid": "9c9eeafa-3c32-4670-be28-8cae7906c333", "value": "FCF3D081E7CED5E0FC079B333EA80EEF52310087691854E4EF29DABD96BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407308, "uuid": "9a67d921-b3db-4e12-b070-e233a0d0c784", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407308, "uuid": "de2f8e96-6681-44db-bddb-b50236138794", "value": "3072:HBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHit:huXLcclWEc2HeSjNjGdeCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407308, "uuid": "a4aa59af-e360-4343-82c8-455c44fa67ab", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407308, "uuid": "baed6264-7ee6-40d1-89f6-046f974c12e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407308, "uuid": "83e197e6-b74e-4bdd-8e01-e3d810e74dc4", "value": "032038ea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d3f73b-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403741, "uuid": "df312e4b-e9fd-4dc9-a01a-a6cf99815351", "comment": "Malware payload (Dridex)", "value": "22390be3f661e4b81d5d4d0dc2f6379c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403741, "uuid": "7f707063-4ffa-4925-8d91-80ba565ed702", "comment": "Malware payload (Dridex)", "value": "68536d795ec509d24ae097a8e46c317d63768e2dac7893d52ea6bf6d381a962d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403741, "uuid": "04657298-a942-42ea-ac97-3d4ee9c11519", "comment": "Malware payload (Dridex)", "value": "ebd34d4587b29cb3b959bb1df14b1f845ec2c5d9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403741, "uuid": "62ab2d4e-a083-470c-8025-50fdf81fe4b8", "comment": "Malware payload (Dridex)", "value": "e17f4d95396932b661d0ba1006a618b4f3186bbbdec3fee9ca9dbe6418b5d7d8775a213ee7f570394d50634ab14532f1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403741, "uuid": "97491a77-6963-47f1-b758-9ba996d2c43c", "value": "5DF3D081E78ED5E0FC075B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403741, "uuid": "2c1c4891-ea9c-4c2e-ba4d-8872198f7b05", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403741, "uuid": "957c122f-d09a-4020-a7c1-8c596b88557e", "value": "3072:YBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHN5:8uXLcclWEc2HeSjNjGdet5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403741, "uuid": "7455b2e7-afde-4372-b858-46cad3e0fea5", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403741, "uuid": "772608d5-187a-4c6e-834a-483687d7927e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403741, "uuid": "45a7bdb6-1bdf-41ba-ab22-5972b25e6081", "value": "22390be3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beea8c8f-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392234, "uuid": "3d2f54b0-ea9a-4181-99b8-60fb1e900f28", "comment": "Malware payload", "value": "8ea9d6db5f460e5c876adf885332ffad", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392234, "uuid": "d7b0ade2-4090-4f2c-af5e-c1ade46c21cd", "comment": "Malware payload", "value": "685a7e3b2de03e3df51f6d5a66bfc8db5b65f61d6df3c8665e2ae058092b5f54", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392234, "uuid": "8ee810e9-85d3-43ba-b147-dfb7f5eb7062", "comment": "Malware payload", "value": "a4ffdcfac6db5bb465da9c7a0ac192305d827555", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392234, "uuid": "2f578a45-37e4-4ebd-888c-e0dd23e5bbfc", "comment": "Malware payload", "value": "3dda3601376949c4f47dc67fcad135e89ec1f0ee8f0f8ae9f3905a5719f9c2e875e818abe699552d15dc95446dfd85b4", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392234, "uuid": "ccae28db-b105-4efd-970f-94b327f3d0e6", "value": "EDA1E850112C1AB17246597AD26FFA52B50EC81B0A777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392234, "uuid": "455927fc-4335-47b7-bc68-8f60374f6b06", "value": "96:XRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:XRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392234, "uuid": "e14bfa2f-92f3-47d8-9537-0b9409972e4d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392234, "uuid": "07fc36dc-e51e-4244-af78-284fb490d3f8", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392234, "uuid": "db62d509-e0c0-46f5-8131-7186fcbdbf7b", "value": "685a7e3b2de03e3df51f6d5a66bfc8db5b65f61d6df3c8665e2ae058092b5f54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3162b56c-af7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620423350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620423350, "uuid": "3d424273-8633-48b9-aa1e-62435608a987", "comment": "Malware payload (ArkeiStealer)", "value": "978537de8e773549b874bdd34a83b368", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620423350, "uuid": "5bbf391b-f796-410d-a8a7-d51f9309e636", "comment": "Malware payload (ArkeiStealer)", "value": "6888185dd5aa73d3b4c61ea8bd10b3c0604845e15092b393f086f803f1e1a504", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620423350, "uuid": "daf18c67-ae3a-4fd3-8621-d92061da1810", "comment": "Malware payload (ArkeiStealer)", "value": "be4846ae16dbb13d8b9ccc8db8ffda37c60048b5", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620423350, "uuid": "a470bc05-fc13-41b6-badd-29e4b2ae5920", "comment": "Malware payload (ArkeiStealer)", "value": "9ff07018338379c4419db6517e979f5a0e97b882161a157fa98337e084f2d774fbd5b6a77ea1d1d3f6d48a5a8353ad63", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620423350, "uuid": "121ef869-a140-4806-95c5-9a6d61008025", "value": "89E4E120A690C0B6F5F311F54DBE93BCA92D7DB15B2440CB23D527EE56386E4AC313A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620423350, "uuid": "a54d7fb1-3f6f-4d7d-83d7-216ed14f6630", "value": "f005994d9c3139288cee35f5ba4b8d09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620423350, "uuid": "219052da-25e2-4cc8-bc3c-a7c6e55f22fa", "value": "12288:55vjNCRQXPeyrditgh0YMhpkl0bjzMc7JY+6u4rwHLWeiVliol:XvoMPjh0fwmnMO4MKeUzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620423350, "uuid": "b5feedf8-5265-4717-8093-1e7da07613c9", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620423350, "uuid": "198777c6-5b06-4048-8ff3-7db5203e924d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620423350, "uuid": "7c7072ea-5038-47ee-8414-573f79552b38", "value": "978537de8e773549b874bdd34a83b368.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b4aa46-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407119, "uuid": "2b5a96db-e678-4f65-8405-07e0a3ea6df8", "comment": "Malware payload (Dridex)", "value": "3d40e3ff61baa853c333e94af247510d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407119, "uuid": "3ecfc0ea-702a-4348-84c5-44be1340a4c1", "comment": "Malware payload (Dridex)", "value": "689e229f75732b3b0a08bf9c7ae4b0b674505c54be3fd7fc78f24ded5c01dbea", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407119, "uuid": "24dc3019-3815-4a81-a622-3ce4340f4d54", "comment": "Malware payload (Dridex)", "value": "294a08e554f920b4197dc26f7a34e7cf2724cb7f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407119, "uuid": "1466e93e-c56d-4531-b543-2e50701c3324", "comment": "Malware payload (Dridex)", "value": "983f61456cc82f89efd2e1488419ea227548755cf637cd4d237c398e9d7d0941b3379e8a2695b0017eb9df8da3d654a8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407119, "uuid": "5da8a76b-ddf2-4285-a46a-979c5f3738f8", "value": "14F3D080E78ED5E0FC075B333E680EEF52310087691954E4EF29DABDD5BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407119, "uuid": "b27f9a54-78e4-47eb-a687-af5e3bdaa8ae", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407119, "uuid": "d4162965-bb33-467d-b701-42e45f561331", "value": "3072:qBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHj8:auXLcclWEc2HeSjNjGdeD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407119, "uuid": "49c2c142-7111-454c-9d6c-7afcbfff29e3", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407119, "uuid": "d90259b8-2ece-4a1a-a942-cb521e4cdb71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407119, "uuid": "a5777474-653d-467b-b91e-93e4200f8c62", "value": "3d40e3ff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a78b819-af77-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620421298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421298, "uuid": "5562d510-247a-4019-8d53-fa224224b508", "comment": "Malware payload (Dridex)", "value": "8fe26dfdc45f06f4201962fecb7b8088", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421298, "uuid": "514ed6ee-8130-4326-8e59-218d0ffb6795", "comment": "Malware payload (Dridex)", "value": "689e7be3743bda3490a78bd6b5719d5b2ff7bbe863c2623dc4c1dd767f7ca63e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421298, "uuid": "b50dc32e-b588-49a4-b1fe-21fa2750da56", "comment": "Malware payload (Dridex)", "value": "83fe3c0c77310e7a773da4c1da71bf7671c43354", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421298, "uuid": "18e92d09-f422-41b0-ad21-565e6f2c35c7", "comment": "Malware payload (Dridex)", "value": "b22697dd034515c7390f8634acaa1d7899900461efdd6628d02bcd765cd82e4d6db83d05b25a14fc11d4f58858a081b2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421298, "uuid": "68165ec9-5235-479d-826b-f641afedac19", "value": "2BF3C141C9C5CCF0CBF36C3A4695963B3228B941995A8E42EC24CE6F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421298, "uuid": "644b209d-7c27-4091-8b78-fe7b2b4f3f3e", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421298, "uuid": "1d0f1164-d35c-456a-94b2-e120f8c6a2a9", "value": "3072:3uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+34:30czbty9uiaJlC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620421298, "uuid": "7fa85f38-f032-478a-946d-7ee19a3daa65", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620421298, "uuid": "e6055976-fd13-4bc7-9ce5-1fd007b69e94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421298, "uuid": "d23f79be-85a0-4b17-8004-de5e83a3915f", "value": "8fe26dfd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6db3a7-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403751, "uuid": "f09faefe-78c6-404c-9610-9e7590e84c9a", "comment": "Malware payload (Dridex)", "value": "bc38fb304cbaf6a86996f5770b74258b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403751, "uuid": "52f28689-29be-4e67-ab59-7365a9f2eaa2", "comment": "Malware payload (Dridex)", "value": "68f71a13c16010d8d02c6a2a56310d3aafb6e75f8a63a6bae5e49815ac531310", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403751, "uuid": "8bf13a52-d2e4-4bba-b6e0-0097bdac2e77", "comment": "Malware payload (Dridex)", "value": "ddbaffa6f01d7a1d5263505bde6ac89b2f6fa571", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403751, "uuid": "c1a1e38f-df76-4b38-bde2-5360e3053f48", "comment": "Malware payload (Dridex)", "value": "86c48f7072e93414a221461cd90ce9f03ed130de2004628dbbce65eada388d4762f77dfb737e64402e4834a41cb85b03", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403751, "uuid": "8a384c06-9cb2-4111-a158-44f9aa559110", "value": "D4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403751, "uuid": "a3fd451a-18f9-4d82-bfa9-fb0c445a7d8b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403751, "uuid": "3fce728e-00d1-4071-a728-df9d61e3c725", "value": "3072:yPmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403751, "uuid": "68e0d2a3-9546-456b-818b-a00ba8809887", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403751, "uuid": "aadd716d-5441-434d-b470-ff43ee5670be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403751, "uuid": "58495494-f201-4499-985f-cbb485f95572", "value": "bc38fb30_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451bf5f2-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620392459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392459, "uuid": "4e416aa6-83a5-4920-bd97-1d32e8153680", "comment": "Malware payload (AgentTesla)", "value": "65680c0a8034a7f1ef17a2bf22690f1f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392459, "uuid": "6cf2103e-153a-4069-bd5d-3de6f466b11d", "comment": "Malware payload (AgentTesla)", "value": "68f87bcac883a46c782a07910360ef362af7fdc09ada100bbc42751ff2f6c863", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392459, "uuid": "417bce7b-56bb-49d5-9df7-f3a689825c7c", "comment": "Malware payload (AgentTesla)", "value": "d25bdf6b9528b382c24553f4c6adba78a1f7b83b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392459, "uuid": "8f7a54cd-1ab0-41e9-90b2-05678414ab1c", "comment": "Malware payload (AgentTesla)", "value": "7d1a215e0fef003c343d154aeff71d6357a836bbc17bd2a32026daf74fdaa06ea54de7dc4519baf1bd4d9a363f587be0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392459, "uuid": "35991aea-ca75-477b-82d0-3f6a9aec1749", "value": "E0D4231AC4ACB622777264C9C271740B3AE1FBD5C942025D4E2328BE738775D6D19FB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392459, "uuid": "7894eb89-bb3d-4d93-b622-78d2176bd256", "value": "12288:A77KCH5mRhhU4I5wPcxdM/7K7i/etES0BxfHWwwt06cPT1bSuwM3acsaAA:bCZoywPcxO2u/eOWwwbcPT0uwM3E7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392459, "uuid": "b737f6f2-d7c1-4ad8-8f59-6aca6672164f", "value": 651025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392459, "uuid": "16c3140b-e5dc-4ba4-9aff-133f66f7428b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392459, "uuid": "7c43e4b4-9d10-41d6-b70c-5633463132e3", "value": "65680c0a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de47f81-aef3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620364476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364476, "uuid": "a065dae1-c461-4e2a-810d-89735528a450", "comment": "Malware payload", "value": "2a872ae7aa325dab4fd6f4d2a0a4fa21", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364476, "uuid": "741d30eb-2f21-4a13-9368-14a60f3bd084", "comment": "Malware payload", "value": "693fbe27170b14efde45d627cf3e0af36143762d2ef70a52a8402f121f6d6ae4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364476, "uuid": "6c81cff0-3ba2-4a41-9051-eefcdd228f41", "comment": "Malware payload", "value": "f55588b089b75606b03415c9d887e1bdbb55a0a0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364476, "uuid": "f55d6f64-9ef6-46e5-b76f-d4173f519c94", "comment": "Malware payload", "value": "7d49888f4e3eb80ce1ea7494c76083e50c22e66ed26a1cb3350d120be27031c13ea089e38b23ad1ca464ea97f3f5cff9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364476, "uuid": "acbdd842-7bbe-4af2-a269-5f24fd1b6e8c", "value": "5132BFF2867EC7F0C7FEF8728666A95408139F5897BE8723520C65D48F8600CD85A9AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364476, "uuid": "db59961f-23a0-4118-8938-179060f7c42e", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364476, "uuid": "62a8510a-4de7-4ced-96bc-37b9977acc56", "value": "192:02n48OF4EuQgIsH7nG9FTqdlO85kbiACYT3xZrk2yVQm3Z+UBzoLKbJP:0jacgXH7nGP0U2toDxZo2QQ0Z+UBz0KR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364476, "uuid": "20e08670-12ac-4528-a947-16389f92e2f8", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364476, "uuid": "6e4e2676-9037-4463-accb-540fc44c744a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364476, "uuid": "047322b9-75cc-4ca6-bc57-66b9cd45f5b1", "value": "kb^fr_ouverture(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2033c9f-af39-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620394843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394843, "uuid": "e05ba48d-cf20-441b-8f80-5fe769a4a860", "comment": "Malware payload (Mirai)", "value": "ddeb1f03acd7d51d039294220006ed4b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394843, "uuid": "74a91302-0ed0-4908-922c-489cc15c7374", "comment": "Malware payload (Mirai)", "value": "69750d6913c0b2bcdc111c2f7ec914a98ac1fc9b58b3bdd6aed608622f5167f9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394843, "uuid": "f510b1c9-e1d0-41e4-993f-06d431f605de", "comment": "Malware payload (Mirai)", "value": "8c1cad7a5ced82324331f32e1f88a18003afeaec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394843, "uuid": "5ea8dbf6-17d9-40f2-88c5-dbd587fd5cb9", "comment": "Malware payload (Mirai)", "value": "2eaaeeb63b78c57bfd415a7b302e45be3abda0f2e25c95f9e48d8584fcceca62fcfee20841a17d66b248590a13df9d5d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394843, "uuid": "b6f5de94-b5c9-4687-959c-bde2d3075c80", "value": "1B733BC06D53D8F4EC1215716433EB329A72E03E2139EBABE7ADAA639D42741D40739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394843, "uuid": "0c7ac451-e91a-4ab9-bd60-29a5356ca4b3", "value": "1536:Khq0IfxbQKEkHL9gzqC83to4FOwZt2dckCM16qUBAA82pVd38ENGHW2/E/32C:bbxbkkHL9gzqzo4FOSt2dc7M8XC9mxIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620394843, "uuid": "cac1bf90-a5cb-42a3-b3c6-d2f806145dab", "value": 74832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620394843, "uuid": "4dd00925-8286-47b8-a63f-c0f84b7c4d58", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394843, "uuid": "10279e5c-c893-4acc-aac2-ae2e6bfc7774", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ff178b-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403354, "uuid": "bfc28a37-03f3-4a00-822e-f11f4ccd74d5", "comment": "Malware payload (Dridex)", "value": "ea4a94b276833438f3bad1ea965ea76b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403354, "uuid": "cd2d1580-5955-47ea-b0b8-d86965253977", "comment": "Malware payload (Dridex)", "value": "69909b2c098fbe9c89dac005f3865aaa98d08db478d337740de6a11fff25cdb6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403354, "uuid": "d2106eb6-cf3b-4705-a312-3cc4544104a3", "comment": "Malware payload (Dridex)", "value": "37d9b13cbdcd54283cf5285621c235ec50377499", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403354, "uuid": "b662bcd2-2d8a-40cd-bc05-4c0657f48c6b", "comment": "Malware payload (Dridex)", "value": "f92387aa85141e0fef7bac7fc36e336377372b62d853fb0ef1e5dfed2177391ac3ca2f8fc38af46ea9f35d892849caf6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403354, "uuid": "0e7b84a2-156b-4943-9810-7a8a5b731909", "value": "57F3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD5BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403354, "uuid": "9aa56c27-37f0-4026-b37c-585dc609e4f7", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403354, "uuid": "ba614eb1-13c8-4808-8315-e0d2775a3b07", "value": "3072:KBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHSa:6uXLcclWEc2HeSjNjGdeya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403354, "uuid": "4ce5a8b4-4464-40de-8b20-b46e2dc7a576", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403354, "uuid": "befbba70-3313-4dc0-ba1c-88f0627f5b1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403354, "uuid": "4e031b6c-04d0-422d-b4d8-bd34d4a8610e", "value": "ea4a94b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216a907e-aed8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620352886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352886, "uuid": "77767d15-8e71-471b-bfa1-344f7163f5a0", "comment": "Malware payload (Dridex)", "value": "e44d2ba48e975767f86c16bd59508c21", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352886, "uuid": "5a8555b5-7092-4cbd-b335-f2b7fa41a0e4", "comment": "Malware payload (Dridex)", "value": "6aab0b1c41107a73b3073f93c3bc756ada7599924414de66bf0414271f77bc4c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352886, "uuid": "4b4f7433-7885-41a3-baec-43a3c02eaf82", "comment": "Malware payload (Dridex)", "value": "7103eb4444156ced9bf0560194a72e76f20b32ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352886, "uuid": "364b1116-0d08-461a-a61e-7e88eaa57585", "comment": "Malware payload (Dridex)", "value": "59fa57800cbb62dd5cdb80239ea677f92e7662a5be8c212b84b8ee389572ccfd0c356507d63e6045b7796cea80903a7c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352886, "uuid": "5c1a73f9-c1d6-45ee-a121-22142a1a93a7", "value": "F6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352886, "uuid": "0ba1b5e8-b00f-421e-b082-a627592da05d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352886, "uuid": "f4cdcc12-b0e5-478f-bb8c-66e8c002dbee", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620352886, "uuid": "fcf891d8-3232-4516-ae4b-595fce75f52e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620352886, "uuid": "de0cffaf-c155-4946-b1d5-95b51d3f687c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352886, "uuid": "d4694de1-fa85-4bb2-9e8b-e781aaf6159c", "value": "e44d2ba4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8eba74-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620385303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385303, "uuid": "1ce733e5-2ee8-44d0-96a8-4a2c4a42b550", "comment": "Malware payload (Dridex)", "value": "39f440cf6a96e77a15c641e21c67fc98", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385303, "uuid": "90143a75-d996-4cc0-a9b7-83cc792b8550", "comment": "Malware payload (Dridex)", "value": "6ac7e3b8db86a6910b91f903c509eec2c74b7cf352bc30710b5ed0ee5d9ba9bf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385303, "uuid": "d38faddb-8eee-40f4-a09e-e334ebd0fc4d", "comment": "Malware payload (Dridex)", "value": "17f2644333aac3b25c105ef6978bf37264e77ec5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385303, "uuid": "1f9f6dc2-6e20-4bdb-bc13-dff115af161a", "comment": "Malware payload (Dridex)", "value": "aa84a1f53ed2698d865bec2cf2a1c8d667ddb08785b0a7bdd90a74f7b1b1a746b1d3308c2a2d3a0e9b047415367f5775", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385303, "uuid": "67881333-e4b8-483f-a637-598610ef8253", "value": "3CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385303, "uuid": "554fe57a-01d1-4349-b170-d46fb3817021", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385303, "uuid": "e65b9597-9ebb-43d4-ad99-97ac37cc89fc", "value": "3072:tlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:tlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385303, "uuid": "c4bc412d-526c-4769-9c75-1d4913b527d7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385303, "uuid": "3d340acd-da74-4d58-9134-8fdf94453350", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385303, "uuid": "b44de02a-cff5-460a-a655-127b741a10c0", "value": "39f440cf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd96b4f-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407342, "uuid": "6dde85c5-4fb5-4794-920b-5397c435d253", "comment": "Malware payload (Dridex)", "value": "224c362e0f0f687813de574d047e6a06", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407342, "uuid": "3e9e424b-aef4-43f9-a9c3-d2fc8037b7f7", "comment": "Malware payload (Dridex)", "value": "6aebc4c168e9a80622f27c4898499347105dce575a398dd8f3318e661dda0c78", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407342, "uuid": "6b811003-19be-48cc-a7b0-00e8ddc808a5", "comment": "Malware payload (Dridex)", "value": "7edce115ef5e447b6602e139d6d05449d29c66b8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407342, "uuid": "ad81af8e-40d6-4b00-9434-85a71670cb55", "comment": "Malware payload (Dridex)", "value": "78cde929c8994250ef89a558c0ce699502d1add70ce376c9540e0b456250d0926f08bbb1d88b20404f5680a833c9f786", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407342, "uuid": "211907ab-afec-449e-aa40-d6a3103523d0", "value": "69F3D081E7CED5E0FC079B333EA80EEF52310087691854E4EF29DABD95BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407342, "uuid": "7acb9963-f8cf-4df7-9627-e3b00033f18a", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407342, "uuid": "4823f7f9-e040-4396-882f-742dd8ebbb14", "value": "3072:1BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHtZ:7uXLcclWEc2HeSjNjGdeNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407342, "uuid": "d38b559f-7571-4206-8396-2504d6835b3b", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407342, "uuid": "83d5adc2-169f-4d77-810d-552b9e58b03e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407342, "uuid": "2f0a7e84-594b-424f-905d-eae71df4bd04", "value": "224c362e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a53b6b-af88-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620428491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428491, "uuid": "7c6466f1-a66e-47dd-b290-2bf9fe960582", "comment": "Malware payload (Dridex)", "value": "80bc855722db80cd5c7397b1b1f7aa62", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428491, "uuid": "625248ec-fb34-48ed-ad27-213e49fe070e", "comment": "Malware payload (Dridex)", "value": "6b09b5110c850e296a6ada0daa65e7b5ac1eb3085a5abbfb119bc175b7d0e91e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428491, "uuid": "0126f2ab-77a4-4dbb-9efe-fe360b9601ca", "comment": "Malware payload (Dridex)", "value": "a981f438a267e927a396e68e55fe56a8e6e6211e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428491, "uuid": "670d2be1-139f-411f-83d7-a44d42a9fbb2", "comment": "Malware payload (Dridex)", "value": "f4c55a35aa576bbb1fe9e5e2ed90ff4de050b78fc609b3dcc18ed773ed88d9c56a35439c517ceb57c17d8ebdd880c2c0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428491, "uuid": "93eff4af-d7b2-46b1-abd5-0f15c7bd177d", "value": "3BF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428491, "uuid": "fed0c07c-da5a-41ed-957c-b71c9bcabbff", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428491, "uuid": "05e8977b-25eb-4f85-bc39-28d70e9b7c4d", "value": "3072:VWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:V42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620428491, "uuid": "f37803af-634b-4c7f-a5de-84c54052ad2a", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620428491, "uuid": "53f7faff-973e-4c5f-ab72-c939da991f9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428491, "uuid": "e356cf87-cb6b-4524-b96c-c82998093f2c", "value": "80bc8557_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bdf630d-af77-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620421301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421301, "uuid": "89bd7246-99ff-4257-908a-33d505aece86", "comment": "Malware payload (Dridex)", "value": "47b75b0faffe3cd2786a7679bcead891", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421301, "uuid": "52f53f5c-b184-4ea8-b507-5ff1b8e2aea8", "comment": "Malware payload (Dridex)", "value": "6b4eaa731296bde18325c56989d574238f470fa196a9c69cfdea47cc34308280", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421301, "uuid": "c9eecaf9-f73d-4cba-82f3-a0696fd78156", "comment": "Malware payload (Dridex)", "value": "79b9d9d7f07d4e9a80a22d3b496a14bcade6efcf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421301, "uuid": "a36125b7-d1e5-475c-8fee-2d42ce453fa5", "comment": "Malware payload (Dridex)", "value": "74a3bd289c290356a002aeff3a6c30ea4519fe6997854b8acd8cae328910e2dcbc920a72a561690172e5f70223b43453", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421301, "uuid": "bf6424c7-e22b-4461-aa82-50ce30f182d6", "value": "ADF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421301, "uuid": "18a876db-4caa-4298-aaf0-982ef5f6d7e2", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421301, "uuid": "906626d2-a91c-4ec7-9109-82f488e5ef0e", "value": "3072:kWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:k42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620421301, "uuid": "9caeae06-d3e9-4814-8741-12971a94446b", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620421301, "uuid": "a6b71340-c3e8-4dda-80a9-5f6d2373a53e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421301, "uuid": "d5bc6dec-1e31-4c00-87f1-7cc80dbab3a7", "value": "47b75b0f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac9df81-af3f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620397113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397113, "uuid": "e868398f-1f57-41c2-a96f-cabecc76b00d", "comment": "Malware payload (AgentTesla)", "value": "38adf3605c1285a02dc40947cab22a11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397113, "uuid": "19b7e610-f6cb-4941-addf-0a9ee38761c2", "comment": "Malware payload (AgentTesla)", "value": "6b67cde90622aca6675e3187802b55e573bc0fa95c75c3581e69b57948894436", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397113, "uuid": "b40c9fce-0be9-4ee1-8a13-2c76cf15527f", "comment": "Malware payload (AgentTesla)", "value": "35723bd842b5fd40df05db2e2125f12d3d7c2211", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397113, "uuid": "06c18ffe-fc43-40fe-8647-70afa13d6209", "comment": "Malware payload (AgentTesla)", "value": "433031bde5e15421096bbae5954ca35d0da8081aba078ebe2b354e7c9090da64b4a99cf9e627bdbc99881a6761752090", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620397113, "uuid": "6a08d473-b563-4719-a320-8c69a9b0feda", "value": "9B85FC3A73F6876165F3236E3C2AF7E960A63FBA7034D7E44A14006D53824550AE63BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620397113, "uuid": "61337c91-c7c2-4ac4-b00e-0c4e5e7e4814", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620397113, "uuid": "beba98ea-cf65-40b1-bc47-01b861346a95", "value": "768:k2ee0pA4m4RkBuN6c9sI7TsiSPgySIfx+6iUK7XjsqsyZJphRgAa5K7lwEqkQ1Dp:ZGAoW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620397113, "uuid": "94cf0c43-afb1-4ad5-ac70-33d6d68d39e2", "value": 1823952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620397113, "uuid": "7f39c1e3-b6e0-43b7-b68d-542be6f11043", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620397113, "uuid": "fd4b86e8-1733-44f3-9a3c-300854186d42", "value": "urch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5639f0bd-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404084, "uuid": "403c52d8-d4c3-4e16-9147-e84b01277139", "comment": "Malware payload (Dridex)", "value": "c59b0705575da51b6d72c4553adefa28", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404084, "uuid": "0ce42f22-40e1-4019-9e31-2b7f65ebd94c", "comment": "Malware payload (Dridex)", "value": "6bdfbe9cf016aed8589e38e42794c85de6510e847a1f3f0e6cb2764d2fdb1716", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404084, "uuid": "aa29f61b-4e35-4051-94cd-2f98ba2b18bc", "comment": "Malware payload (Dridex)", "value": "330c567d9d38a2a1686170da343fde63da3febe9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404084, "uuid": "a31b6109-eaa8-421e-8b2b-49e09b6ff066", "comment": "Malware payload (Dridex)", "value": "7c3d5453ee3f4394dd1bc8ca16b6fadb2f74c34aa33a8037098f2291dd789e50e2c494975c5d9c1eaa2ba63322b33d3a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404084, "uuid": "2cc1dc60-cec5-4cfe-ab4a-8ad793265667", "value": "E6F3C141C9C5CCF0CBE36C3A4695963B3728B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404084, "uuid": "9e9fdb87-177d-43dc-a8ab-505179047e33", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404084, "uuid": "37f58e7b-2d74-48d8-8f05-0eea712a802f", "value": "3072:3uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+zN:30czbty9uiaJlGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404084, "uuid": "01247e0d-3f63-4408-bab0-9888808dbe49", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404084, "uuid": "81be0733-7f9d-424a-813f-a1dca473fe35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404084, "uuid": "05eb9d79-a22f-4334-885e-e48be0c191f9", "value": "c59b0705_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6978d9-af09-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620374295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374295, "uuid": "b436f37c-6214-403d-9811-0523db7428dd", "comment": "Malware payload (AgentTesla)", "value": "f770038b37702193a086d66371832fbd", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374295, "uuid": "8f0a3e75-3301-45b3-9d54-51e0b9f08179", "comment": "Malware payload (AgentTesla)", "value": "6be43ab36faddafa332267ee763dd5b58fbe5e23d1a3a14e61f07c29c04647b1", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374295, "uuid": "d30766da-d463-4b49-997d-777f3caedb4c", "comment": "Malware payload (AgentTesla)", "value": "4c4b8714e9b9ea4f7c82fea97b3df362ec555240", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374295, "uuid": "d745109e-b1f3-4c60-8e0f-f0c617e87047", "comment": "Malware payload (AgentTesla)", "value": "506378a32c210d2d2e3d586e30a0abd2b29b557a41ec3be6cf9a4eb835cb3ed4b2348075059e05845976c924e16292e0", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374295, "uuid": "6f59fb54-25ab-45ba-9e98-339c5bc7156b", "value": "0AE423A1953DC880793B7344ED092A2E4804EA757C9D628CEDFB238255C8DAFE52CD63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374295, "uuid": "279998ad-eb80-47ad-8078-42f58e66c072", "value": "12288:Hune/LQSinJDIY8iN5QW897Uo+QoQpv2oIlrAmA24307NpMBgTN2t35+pYfYxGmG:HugLBinJDIY15X8O5tQl2oIlH54EUB+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374295, "uuid": "d37b7975-5b97-4a28-88c6-1650b4d44c6f", "value": 663532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374295, "uuid": "2db79119-0f94-423f-bbdc-69ff48e46cbf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374295, "uuid": "a65b6247-28c6-48f4-8078-615bb9b6e131", "value": "proforma invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8901e96-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407363, "uuid": "458a6ac2-0e03-4c01-84b6-cccfc1a3fa0f", "comment": "Malware payload (Dridex)", "value": "381c67acbb1e9f4f2978c4c54cca48ad", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407363, "uuid": "e955486b-39c3-409f-b4e4-01c6e5de810f", "comment": "Malware payload (Dridex)", "value": "6c18fe40a8dfa8f285daef6114d72bb0cd73c5d468fac41d5bb82af4070ddb6e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407363, "uuid": "46a7859c-f650-47fb-90c0-191fd88b351a", "comment": "Malware payload (Dridex)", "value": "84a2c9285df97cb3565bc9f3555210842372f1e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407363, "uuid": "5ac9633f-795d-4582-a4f5-3efe7862639a", "comment": "Malware payload (Dridex)", "value": "5dc296f7ccc761d1479af9531abf71725bd4ce80514c8b0018b61e33480e6cd0ce7805e7376cc879d7d453e2d7623b60", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407363, "uuid": "c72b664b-51e7-4b41-af88-fff7d424c236", "value": "3EF3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407363, "uuid": "ab3d4c64-bcdd-4c75-9372-6b9a07220e0c", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407363, "uuid": "c200e7f5-b22e-4794-bd0c-0332f5c3efa0", "value": "3072:TBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHqE:FuXLcclWEc2HeSjNjGdeKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407363, "uuid": "41044750-b33e-4a84-aa96-503cbf3b6867", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407363, "uuid": "57ee36e9-3cfb-4b3c-912a-68d07c243d28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407363, "uuid": "f63da589-5643-4391-a74b-04d2c0e4a873", "value": "381c67ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "014e2b6f-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407378, "uuid": "903cdd06-b02b-4368-a3d6-2d77d51aaddf", "comment": "Malware payload (Dridex)", "value": "be509f1ecc66616cf82838bf206cbd0f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407378, "uuid": "2e2335a4-13aa-4ce8-8a2b-856193e1447a", "comment": "Malware payload (Dridex)", "value": "6c3d2d4c8e2f307c457d9f370b715f078ae40de0034e7c1b9ff41c0d13713119", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407378, "uuid": "15ab5ce4-7693-462d-b657-1d0df4e6ffa1", "comment": "Malware payload (Dridex)", "value": "1894146ee696202a57b4b72e19a16aa53b8da545", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407378, "uuid": "8a61884c-70eb-4352-b24d-1fcee3070e92", "comment": "Malware payload (Dridex)", "value": "b61c11638cfea322417125dadfe1311c03a39d61cf4ec9c43a31dadf5de1ce2c42de0e1516fb340f923f944bb79185ea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407378, "uuid": "1bf07c96-49e9-4760-9f57-2fdd6645683d", "value": "92F3D081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407378, "uuid": "33f97dd8-bfe7-4505-8570-64fcb732d0bb", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407378, "uuid": "90f821d5-c015-4deb-907f-be15a9ee7426", "value": "3072:6BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHNz:KuXLcclWEc2HeSjNjGdetz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407378, "uuid": "a2eacb05-e4e2-4d1c-baa9-190d9a684acb", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407378, "uuid": "6137a4e4-1828-4a1c-bd7e-abbf94f11845", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407378, "uuid": "5a745227-6fd7-45c0-ba14-33bb9123af7f", "value": "be509f1e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d470324-af88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620428470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428470, "uuid": "0ba78c36-a94d-4cba-b7c6-9a456549831e", "comment": "Malware payload", "value": "49b8c719355ac644fd39c621c0fb9760", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428470, "uuid": "9a6adb85-788a-4b5a-b794-8b2a190a8407", "comment": "Malware payload", "value": "6c54e8586f58a4a3de8b80c9a89a28054b19e6974472851fb4936bb19ed54a34", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428470, "uuid": "e1d56649-97d6-4a6d-8fe8-ebbe50d9a29e", "comment": "Malware payload", "value": "357ba3b6181b2d73e653679fb50986286bcb5f9d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428470, "uuid": "17ae4956-3b76-4ef9-965a-a8c150a76a77", "comment": "Malware payload", "value": "e0b40ad32ef6effb22fe36b5897d6f6712074ea3bd1eb904c1da47cc06662496fb64c9dc5b874f3df970e7b56e1b9a5e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428470, "uuid": "7db32c1d-894a-477c-b749-b4388011c38c", "value": "3DF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428470, "uuid": "74390bc5-47d1-4bb7-aeb2-824b8ce99a81", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428470, "uuid": "1bf2d89f-44bd-462a-b229-9e3865fa6384", "value": "3072:4iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:DeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620428470, "uuid": "35bf8d9b-5a1a-4b81-a6d3-02be22153d89", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620428470, "uuid": "3b8138c3-945c-450d-a5e9-7e463ddff1ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428470, "uuid": "3672ff63-91b4-4d49-b751-d15faaf3ab66", "value": "49b8c719_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef9918e-aef9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620367270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367270, "uuid": "42f7171f-7934-4f5e-b4cd-ceae05476617", "comment": "Malware payload (Dridex)", "value": "a86cb2f028d30ae1e44f8496db8f6e98", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367270, "uuid": "58a57670-40bf-4967-b30f-90ab888da0ff", "comment": "Malware payload (Dridex)", "value": "6cfed85b3d4c89e102d60c52975b8cc7bc4221c1eb026e03b613e2375747d15e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367270, "uuid": "1e719677-9625-46ef-aecc-48d41cf3eed8", "comment": "Malware payload (Dridex)", "value": "07bafe006171cf5a587ca8c8db1bfec1755fa01d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367270, "uuid": "ae012266-88fe-4e75-a73d-a6d0345d5856", "comment": "Malware payload (Dridex)", "value": "ee821a9bf278a6907b5a9ee02ac39659b704877f32410135280bd52975e29ed0b00b3839638d8514e71518e423a073a6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367270, "uuid": "3990b396-03da-4ef1-b9e3-5e96f3e3ed40", "value": "61F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367270, "uuid": "69b01534-0587-42c4-ab17-f427580f3777", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367270, "uuid": "59449f56-f70d-45cc-b9e5-cc03252159c3", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620367270, "uuid": "60e21835-24a9-41f1-9df3-79054350aea3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620367270, "uuid": "9cf405e9-108d-4ff6-be4a-de21201bdbb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367270, "uuid": "c3771e92-9eb4-4ce0-9b5f-edb8d5537e10", "value": "a86cb2f0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8eb27e0-af12-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620378051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378051, "uuid": "0232f2c8-3848-4973-afaa-6a0940b02226", "comment": "Malware payload (RedLineStealer)", "value": "d15d3eb03c466f207dd401047da792bc", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378051, "uuid": "294dfe1e-5b6f-4eab-b0f6-0c54e6863e8d", "comment": "Malware payload (RedLineStealer)", "value": "6d0083394a549c135820010343353dcfa2929aeaa83f72a50ec60a7263f4ec90", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378051, "uuid": "246e28ac-9bc2-47d5-8bea-b52a3b12431c", "comment": "Malware payload (RedLineStealer)", "value": "cca4dd46f38bfc164a1840907a608fb657d471b0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378051, "uuid": "acaaacce-f46b-46ee-bc9f-dbc13caa776a", "comment": "Malware payload (RedLineStealer)", "value": "63e79302130d74371d808615edd111f7b9aa3634c63628cd9b36d95a74d90107d150a5202509405d8b2c75bc4966906d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378051, "uuid": "cd1c6fe0-4eb5-44ec-9d16-d5f4b53cb3fd", "value": "84763303BE5AC2F2D6511936266C5B403AB978706B24C9E7B3A87C1DDB282D15F313D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378051, "uuid": "c8869c69-ce02-41ea-995b-216dcc23b74b", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378051, "uuid": "d9681471-e2b2-4252-b3f0-e7d4cd117692", "value": "196608:dlMH71Nh9m1yDSuSekgi0O028N+EJMi1DlIz:3YhU1ESNgOuHJ/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620378051, "uuid": "cc26d832-cc95-4f86-9b4f-c95297f3ec0a", "value": 7739508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620378051, "uuid": "47c43846-bbc0-4d56-89b4-073bf337530d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378051, "uuid": "e7a71593-efb7-4100-a860-4a906205a2aa", "value": "d15d3eb0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d9b411-af1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620381747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381747, "uuid": "a3c41bc8-da42-4638-b9e5-9de2b7472ed2", "comment": "Malware payload (Dridex)", "value": "f754388612b9c6fa52dc98280a5bd473", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381747, "uuid": "3dbeb009-ded0-4fad-a48e-2cccd431d6d1", "comment": "Malware payload (Dridex)", "value": "6d550a7161ffdc83ccc5b3a208fe31326cf48bc725863c5dba02dd03c8fbc9e0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381747, "uuid": "824be6d2-2121-4f9f-9075-678cbe311433", "comment": "Malware payload (Dridex)", "value": "664a728163cd9c10adae6df479d5db360902d786", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381747, "uuid": "5e0a9f29-dbbf-4db0-9c23-2d1537f5c815", "comment": "Malware payload (Dridex)", "value": "842c4cb86932b452e99de4feb875efb45769c3d09dcedb2017f663ab917f2a2fe48464353962fb230375be4fe05e07cd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381747, "uuid": "f4e079f3-6850-4680-99a8-84cbaa5d0fbf", "value": "AFF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381747, "uuid": "9fd786a9-9ac6-4aa8-9dbd-0add2619f069", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381747, "uuid": "cf1643b8-24e9-465d-b3da-d5dbd715755a", "value": "3072:rWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:r42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381747, "uuid": "96d4e207-fd89-4089-8e1f-9597e9ace4d9", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381747, "uuid": "89f17ead-48a3-4594-99b5-026bbee6fb81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381747, "uuid": "2d239811-7afa-47e4-a674-4fa793fe1ab7", "value": "f7543886_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881d88ea-af3f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620397296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397296, "uuid": "bbcd3753-0851-48b7-98e3-bab8e05a22b7", "comment": "Malware payload (Mirai)", "value": "d69443ec38ede83d52f4b3a4c44343c3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397296, "uuid": "c6d674f2-c492-40a1-b2a4-b82441c7c6d3", "comment": "Malware payload (Mirai)", "value": "6d874a7693e57a8c37ab55a1f5a469d3c4ecdc25cec3a1bfc25f1db0526de576", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397296, "uuid": "1bf1d95a-11c5-4616-b7f9-ee69ae7b81df", "comment": "Malware payload (Mirai)", "value": "b916520088abe798b487de33bb54262ac7833dcd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397296, "uuid": "c4c1cfa5-4ae0-4457-ba43-9790c1dfa715", "comment": "Malware payload (Mirai)", "value": "e9cb6285a1ab7934e3c90766e8082463867d5ce82e6a3cfbb873ceb1af875400b6174a7df43145cfd20c79e2dbbd3b01", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620397296, "uuid": "720a721b-cc35-4a15-bcb3-42c83e587128", "value": "76332942B22C094BF9E65AB0353F0FE093BFE98024E4B585695FEA458136F331586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620397296, "uuid": "6217e084-9f92-43ee-9818-66c0c425ed9f", "value": "768:/KfsbnHAt1ezbnAgCN7RkIV3fgB1TRNRR7Eg3tbv6VFssuWXwdydJq:k6HAt1ezbnAXZUBt33tbC/3XwSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620397296, "uuid": "041d196e-58d7-4ab6-827f-848c5f9543c9", "value": 51332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620397296, "uuid": "e10ef47d-2997-49f5-a59d-8c2e70ed1473", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620397296, "uuid": "6b22faf0-be14-4dca-a27e-430145d5f02b", "value": "Josho.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14f14d6-aef9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620367327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367327, "uuid": "fa5cf048-a1ef-447b-9f1f-2fd2a63e0399", "comment": "Malware payload (Dridex)", "value": "a40b9a32be8235d3ef2d1d34a52ff8c2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367327, "uuid": "9af76642-0c1e-49c6-a47b-bc878b2e5b7f", "comment": "Malware payload (Dridex)", "value": "6dd98f3ce44acc93e1130866636b77a71a954965bcb320a92c61f09f032f34bb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367327, "uuid": "65ed020d-40f1-445e-be1e-690f884b231a", "comment": "Malware payload (Dridex)", "value": "0e18a6c8a8e662baec18628923cc110974148a3c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367327, "uuid": "1743547a-f37d-4851-bcaf-20bdbf72fabf", "comment": "Malware payload (Dridex)", "value": "e186fd73b471da9649976b8da5011efa7406d72f6f57f5d396fd642aeec311f710ac279e7b154fe1cc950d4f7b491bf6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367327, "uuid": "4418c033-4b48-4049-8756-ff6083a68022", "value": "81F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367327, "uuid": "03c1dbb7-6daf-43e0-ae7d-13cdb2908ab4", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367327, "uuid": "224b480f-0999-4df5-8a5c-887a3de2a88e", "value": "3072:ze45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:i4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620367327, "uuid": "27dd6780-3e00-4e59-8350-3107d8f74898", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620367327, "uuid": "6819f134-16ad-434b-af8d-d42b84ab861d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367327, "uuid": "a5a0c0d5-e368-49f2-acfb-3b0e3c282ba6", "value": "a40b9a32_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acec227c-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403371, "uuid": "1193d8e7-82ac-4ecd-ae9a-597d8b3def3d", "comment": "Malware payload (Dridex)", "value": "31aea6b5ea8113bd6d2434383c3233a5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403371, "uuid": "f735f048-9ac3-4dd9-8fe2-1a046e4ebfe9", "comment": "Malware payload (Dridex)", "value": "6e100c49f41002bab8ae01b94c662581c5d45e6b7acccbd4dc175d9f018533cb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403371, "uuid": "81c1a4ac-8b69-4f5a-8b7a-5aa2e6cbfeac", "comment": "Malware payload (Dridex)", "value": "e2741920e1a9f4fc1584634ce12d04998be81c6a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403371, "uuid": "bf9abbdf-c61f-43a0-8e44-c671e4ed9402", "comment": "Malware payload (Dridex)", "value": "8a1c658d102e304ca83b453e1c2da38cfbed0bbf47325e0b4a830f103eb2d5ebeb2b4e9fff2b692913184b78571f5e7b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403371, "uuid": "c0b8077b-a22b-4121-b530-6c8152dbc70c", "value": "6EF3D081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403371, "uuid": "ea76c2c4-1daf-4188-b02b-24e2774346d1", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403371, "uuid": "296f57df-2995-4740-9a24-02878d34e2c7", "value": "3072:kBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHC/:AuXLcclWEc2HeSjNjGdei/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403371, "uuid": "4e68b6fb-2919-4af0-aeba-7503b68625c4", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403371, "uuid": "ac6b094a-3f24-4ebf-b7fb-d3fb4b0c2d42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403371, "uuid": "f8e23798-7979-41b7-8352-1e75fbf6f9ec", "value": "31aea6b5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f56605e-af0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620374464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374464, "uuid": "d7b8f9fc-75ed-4f15-8803-970c07412bee", "comment": "Malware payload (AgentTesla)", "value": "cb34e8abff12690a40eae1a31c9e156f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374464, "uuid": "9731b0fd-3dbf-4363-a667-11fa609fccdb", "comment": "Malware payload (AgentTesla)", "value": "6e50d53f2cfa820f9d1ecd853f98e069798a23577a7fa75665fbbe8d44cb92ae", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374464, "uuid": "e2ee2989-cea8-4fc9-b72a-8056ac480852", "comment": "Malware payload (AgentTesla)", "value": "14270ccafff6ff7626a06f111fce6bc82727e2fc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374464, "uuid": "2023085a-d5bc-45bb-a4bc-663c82ec764d", "comment": "Malware payload (AgentTesla)", "value": "60a359372adf044299cb8f5dcee2bb61ee8414c7ef97683c909910bb6273bdcd5f484443070fc53f93aa6bf07c2c10e2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374464, "uuid": "ed78db97-bc41-4c52-801d-c04f19d26547", "value": "86D423E22F3690222245E225264C91B59987C7FB0FBBF1783FBE557E8845D98C3707A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374464, "uuid": "296cdb70-e7c0-4845-b0e0-446a92e343ff", "value": "12288:68parfvRCfyKjHzJ0sygoGWlWajoctng5WnkiXHc9M66X0d6EqjuUVHM5:684LiyKjTOX/jvRg5WBHc21Xs0g5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374464, "uuid": "d3821838-8658-4dac-9cb4-c9f6f90c40fc", "value": 620385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374464, "uuid": "8f1a5cd3-4eb1-41c6-b2a8-798a1a95b20b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374464, "uuid": "71174773-5724-45c1-9736-3cdcb62289e0", "value": "cb34e8ab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322c24d1-af0d-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620375677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620375677, "uuid": "0cf7f9f0-d231-4700-83df-3bcb4627e48b", "comment": "Malware payload (njrat)", "value": "39d15c9a08c960116d274e38c11596e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620375677, "uuid": "7da3c0c0-2ffe-47fd-b022-28f7d590a44f", "comment": "Malware payload (njrat)", "value": "6e51e43998abedba64180c3c2b4c6c36028ad00706ad37e3baca1562bc966909", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620375677, "uuid": "2bc4baa1-cba4-460b-bdd9-2b0cedc0a65b", "comment": "Malware payload (njrat)", "value": "06e18a40e35f3179e1d50ce272c9cda33e85bc42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620375677, "uuid": "d55973e6-d194-4a48-bbf5-d84e2f7f8546", "comment": "Malware payload (njrat)", "value": "3d97f583f6620db7790db83672e9a161b12985ce35d83879f4e7a68d86847ec03ae31656036db0fad4eddf30cb891902", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620375677, "uuid": "333eb167-d220-4e69-88fe-88e2319c0aec", "value": "ABA43ED7C4432F6DCFAE90618A3289DFA59D0ED978BA3A55E133B40C5D450C4EF286AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620375677, "uuid": "6bff21b6-4054-4a56-8c7d-1427d436336a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620375677, "uuid": "e8667b8d-ff2e-49c7-aa52-02ede562d2f4", "value": "1536:hyZn6Yf/xb+x4SDMGWHOFa2pcshEMrbQgIV8nW:kZ6oV8nW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620375677, "uuid": "247ee55b-28d3-4a90-b0f4-c8b46f30c9cb", "value": 460264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620375677, "uuid": "3d8b6aa6-189e-4259-9159-0907296ce4a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620375677, "uuid": "3dae97ea-de06-4501-8ec6-5699ab65f34f", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97819095-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404194, "uuid": "ef9a417b-5be8-44b0-9bff-27dbeb9b274a", "comment": "Malware payload (Dridex)", "value": "027c625b65c52e0a6a5a50849b5c6e70", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404194, "uuid": "4930dfec-b36a-450b-b3dc-53f84a567e23", "comment": "Malware payload (Dridex)", "value": "6e6bb66b45bea6f675fc6db5a91c55c41433820f185ea0907dd3d725cc3f143d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404194, "uuid": "fcc5f324-a723-462f-967e-6afefaa9f581", "comment": "Malware payload (Dridex)", "value": "56da0a7b5ebf3ac4dc2102b6d209c7554784212e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404194, "uuid": "334885d7-2336-4388-93df-cfe8dba5642b", "comment": "Malware payload (Dridex)", "value": "20b55995aab75f4b753f4faa3e5141eb6c429480bfe3e9ac31f6865c01fc160c9a0a5bf50d466c2812b567fa065c6c74", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404194, "uuid": "0682347f-a52b-4b3a-8efa-a9effcda29dc", "value": "F5F3E081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404194, "uuid": "8d8a8c60-52c1-4ba6-a39c-1a48d6af58da", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404194, "uuid": "76df9d1f-6f8f-4124-87a1-7fd0f2f5031e", "value": "3072:7BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHAh:9uXLcclWEc2HeSjNjGdegh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404194, "uuid": "ef98b8ee-d030-4e0e-b52a-303aa688cdaa", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404194, "uuid": "34e12fad-0a5f-4cd7-9d08-dbc928548fd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404194, "uuid": "3bf85d6a-e948-4fd9-b822-f3f5025995e7", "value": "027c625b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abfdbdee-aef3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620364715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364715, "uuid": "bc6b8021-8e21-46cf-bf52-769e77da8548", "comment": "Malware payload (AgentTesla)", "value": "8d77e7380f3bdbea0cb6ee4759496782", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364715, "uuid": "a66d4da0-26d9-44c4-b1e8-0f14f9109fda", "comment": "Malware payload (AgentTesla)", "value": "6e8ac50a9010c4a45d57ee0095c2cb1989ce6d4a453746920e1dcb3ec43e3c85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364715, "uuid": "2d8a30e9-b562-475d-9dac-7c736a4e4ad3", "comment": "Malware payload (AgentTesla)", "value": "922bd3d631037da3f86c99558f99c468f7785742", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364715, "uuid": "8e9e576b-bee0-45ed-a9b2-8314672348b2", "comment": "Malware payload (AgentTesla)", "value": "b602b5d1cfa33e91465bc913f40262ba5a14559699b4e8a7f259330d29b6f1e9d595509c17bc41d6ad8c5a29c277f934", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364715, "uuid": "3c240cca-95ff-4fb8-aeb6-1b4c6041c3c5", "value": "0605E0122382DA51E9299778E06013F017F6BE41F722DE0BEDD53CAD7976EE04799283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364715, "uuid": "a384b224-34fa-41af-9f58-0e2acb386e3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364715, "uuid": "c68e6134-e158-43ab-9fb9-10fb2f4cdf64", "value": "12288:Z2LQvD6Fl+Y+uo5TkCqABixhJnX4d0UyZP+v/s+34RTwgcFjzB/4M:ZsgpYJo5TkCqXtIeX+H6TfcFnB/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364715, "uuid": "a625e97a-c9cf-46f1-864e-f5b3623fc710", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364715, "uuid": "e2e3e1a3-bb1a-44d8-b1a3-458f19e0a0a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364715, "uuid": "36058a71-52c8-4a03-87a0-2576790e011e", "value": "W5j0XfiZ3QXv9je.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba372976-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620385354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385354, "uuid": "02fa493c-7947-4822-9059-c1d1b6d71bf9", "comment": "Malware payload (Dridex)", "value": "fc5e5874acfcca12b400f3e024894afc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385354, "uuid": "c95fff64-e2a8-41f5-8fdd-a8274f4ed23d", "comment": "Malware payload (Dridex)", "value": "6e904e9d160726ba1bc4f09b691a480aaeeb4ad13eb7f735f44dce5dc66a52ef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385354, "uuid": "bdec4f41-9ec9-4182-94e0-b5db15853b17", "comment": "Malware payload (Dridex)", "value": "98572738d3fb7e30a5aa03357f6c9086c942a378", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385354, "uuid": "fb4dae05-3805-4864-b2a1-4974a75a0b46", "comment": "Malware payload (Dridex)", "value": "e39303af22148286afcc8d0d8a8c4754f239e468208b75fcfd4d8cd358b1597e1167b72f394c8b70dd3389445e815dfc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385354, "uuid": "11398e26-db96-4d04-8c59-74fa195158b0", "value": "1FF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385354, "uuid": "1e485baa-5c32-44ab-8338-1e2317e9355f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385354, "uuid": "8234e623-7148-4e62-9951-4d25920dc821", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385354, "uuid": "a31dc36c-0897-4c70-8796-a58308fb2419", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385354, "uuid": "5a0b63f6-2bca-4b90-8c56-87d31672f7db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385354, "uuid": "516100fe-8ddd-4583-8c40-4ae9bd04b601", "value": "fc5e5874_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfde04fb-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403832, "uuid": "b4a90bdb-8af4-44b6-a4e1-c26e33c15b9c", "comment": "Malware payload (Dridex)", "value": "9814acf48a17dbbb324f3659aa557b48", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403832, "uuid": "4c18b329-80b1-47e8-ad00-14098cebc241", "comment": "Malware payload (Dridex)", "value": "6ebf46975375622f7cb9334958d31116c1f02ff39765cf710d3a4662d2bd3432", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403832, "uuid": "5b91efc8-88c4-43d2-a43e-6ae5e1974e98", "comment": "Malware payload (Dridex)", "value": "4b092c425d696208db18fc9452b54cb164e1d179", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403832, "uuid": "c794ad74-f946-49d8-86cf-15b48e127ba6", "comment": "Malware payload (Dridex)", "value": "e463fa3d5d8a343e3eacd001daf5451c087bc20d3de641af41f17426ef82a959440962fa460385706efc00e73bd510b7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403832, "uuid": "a17c1753-4113-4ba7-9574-9f731ffaf334", "value": "E0F3C141C9C5CCF0CBE36C3A4695963B3628B941995A8E42EC24CE3F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403832, "uuid": "a3a23099-0dc3-485d-8221-497e288791c3", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403832, "uuid": "67edbf5e-2cde-41be-82c1-90529c7a4982", "value": "3072:7uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+3n:70czbty9uiaJlWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403832, "uuid": "6df0271f-3e2d-4af4-bd1f-afbb96b8e36d", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403832, "uuid": "67d1ce5a-2a38-4389-9e43-89ef0f59492d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403832, "uuid": "0f190feb-1416-4e70-8e5d-bcdc2213a295", "value": "9814acf4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef3abcd-aee8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620360102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360102, "uuid": "199370b5-fe4b-42c5-815c-d5c2d7b401e7", "comment": "Malware payload (Dridex)", "value": "9f847ffb63a9b444488d672221cc7b28", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360102, "uuid": "9e3a9f01-65a4-4f10-83fe-2939946bf5ef", "comment": "Malware payload (Dridex)", "value": "6eee042bd6c0255202b0080f8d191c387d4a298f66bcbb076930f06ec4a0ac25", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360102, "uuid": "5600fa71-9df2-412a-a012-b9f168a64442", "comment": "Malware payload (Dridex)", "value": "f7ad0f00ba4292aefab7a2ceb0adca936094589c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360102, "uuid": "6005bb10-9eea-41fd-bfd1-cd12770e4566", "comment": "Malware payload (Dridex)", "value": "f804549dc2e622715c83ee8d59fa2106c14ce8b0011a14be3a7b21ec7c9a1cc959e2d789b5a0eb2862bc28bd5f17b339", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360102, "uuid": "802b5237-c1b1-4d5d-9c52-431bd71c6084", "value": "19F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360102, "uuid": "b0d01c40-fdea-4b7f-b96a-ecbefee8acfb", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360102, "uuid": "024b3c81-d189-4cde-ba62-07d6ec9680ff", "value": "3072:glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620360102, "uuid": "c7492ff3-c36a-43ef-b35e-66afdd86adb6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620360102, "uuid": "4288ab38-0a3f-4788-adce-7d231bab078a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360102, "uuid": "60d7ffef-8baa-44c4-998a-71728069f913", "value": "9f847ffb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c8e9ba-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403758, "uuid": "d2615376-069b-45c4-be92-121ef4b37113", "comment": "Malware payload (Dridex)", "value": "e068315aac06403a9c086db91e4c78af", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403758, "uuid": "2a5e81f3-9e27-4a3b-8a6d-b567806103ff", "comment": "Malware payload (Dridex)", "value": "6f487a9f169f6f9f4ae2e95e8244bf676c8ba875cd89be42ce8adba96ba6d241", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403758, "uuid": "2b89691c-a6bb-464c-b938-df0730d1a24b", "comment": "Malware payload (Dridex)", "value": "4016d26cf9cf0e21eb40d128f3188f4294e4d663", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403758, "uuid": "fe0a46dd-9d2d-4a01-bfcb-56368ee56e3e", "comment": "Malware payload (Dridex)", "value": "eca72c13f7ce1744fe3ab8c16b7d2be0b3258ce8816e62fa298b9a534a3ac74ad450c08f479d8d0af036a60a43cb5ef8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403758, "uuid": "a81980b3-e1ba-417a-9351-de464ab39204", "value": "07F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403758, "uuid": "109ea526-e509-4215-b78d-5923581609ac", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403758, "uuid": "1a0cf722-674e-4c5d-9c91-4d728d93d3a6", "value": "3072:jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403758, "uuid": "52f1d1ea-18be-4cc6-9859-55c9b36bd1d7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403758, "uuid": "7ce3d333-02e5-47d5-8297-43684fd09bbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403758, "uuid": "97fff1a1-6c3c-4c94-970c-5a6850223ee8", "value": "e068315a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73522eb-af1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620383739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620383739, "uuid": "53aa4f8c-180d-4b69-b104-baa1bce4e33b", "comment": "Malware payload (IcedID)", "value": "dfa62565b68736dc443386d68388b269", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620383739, "uuid": "d8290605-4f1c-4cf5-808f-14ceb327213e", "comment": "Malware payload (IcedID)", "value": "6f57eb37bff30df1a66f848cb648799536dcbc05f6fb32d1ae071102ffd830ee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620383739, "uuid": "0e561f8d-b27b-4c56-91e1-545a3e2c952c", "comment": "Malware payload (IcedID)", "value": "d64a755f001658c7bc037049259f23807105d8ba", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620383739, "uuid": "eb50fb71-62a1-461f-a3d2-bc650cf8b672", "comment": "Malware payload (IcedID)", "value": "028a78e273302244ebd0abe783d54ed3fe240c2c3e29146ca311fe0a82e1ab1a48c2b5ade90a5ffdecac0ffe729b4f0c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620383739, "uuid": "17e2d2f0-0981-4051-aaa6-a115f4503857", "value": "A2346266C598D1BCF2476871357CAB58C550AE80AD12DDE3FAE6C412AF239B123213DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620383739, "uuid": "12351cff-7840-4c81-83a0-7bae5143a6e0", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620383739, "uuid": "dad64ced-151a-4f50-8b76-4cb6b4d532e7", "value": "6144:dJJLaU1mUGduNzGSijExi3oomlnG9PS9sfr8mnOySgEBmvpmCZdXWdyqL28888Ie:dJJLaU1mUGduNzGSijExi3oomlnG9PSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620383739, "uuid": "55bb6b19-e182-4374-8e9b-9d96ce35a838", "value": 240216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620383739, "uuid": "1b37f92f-9828-4a0b-bf52-ccaade84faa5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620383739, "uuid": "2ecc4f8a-d34f-4e96-9367-849817918e29", "value": "6f57eb37bff30df1a66f848cb648799536dcbc05f6fb3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a2f0d1-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407301, "uuid": "5fec19b2-2da6-409e-996d-59a002b21501", "comment": "Malware payload (Dridex)", "value": "2cb3c7f1ed8911a281cb801a5fc300f7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407301, "uuid": "43252899-5a74-4693-bb64-5aaca5c04e92", "comment": "Malware payload (Dridex)", "value": "6f711d232da63eb002e1ea4b5ade91607fe4ae0108eb86bf1e02616c2dc34e66", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407301, "uuid": "84c7c6f0-562a-4ca0-aa59-d07401d6d266", "comment": "Malware payload (Dridex)", "value": "4cb2c08fdd726dbc053508ee365b8c3628c65e09", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407301, "uuid": "b97c03fe-5d09-4bf8-82da-d71baa1c799b", "comment": "Malware payload (Dridex)", "value": "c91ee4435f121af11f6d6df4b94e94a64061e89b9534c680fe6f671fa17b50c2db73ec21ad378960668d4fc5b89140b2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407301, "uuid": "c72aabb5-2c07-4236-90ea-682770943e98", "value": "8DF3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407301, "uuid": "1c877d00-4bd1-404c-b241-ac1eb714f288", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407301, "uuid": "6b0c368d-c265-4ff4-b32c-31208efd85a8", "value": "3072:JBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHPD:XuXLcclWEc2HeSjNjGdevD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407301, "uuid": "5d0fe574-c059-4178-8189-504679d8bcf6", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407301, "uuid": "f20532c3-3a5e-40fc-a2e5-24fe8f7b7365", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407301, "uuid": "51b30b50-ba2b-4237-940e-6ed044f181b0", "value": "2cb3c7f1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e36024a-af2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620389441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389441, "uuid": "b367ff1b-a5c9-4fe5-89ea-71242fb23aab", "comment": "Malware payload (SnakeKeylogger)", "value": "94827bd1c00bef75011920ef01e22a4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389441, "uuid": "5febb734-4dc9-4dd8-93ec-e444d581cbe9", "comment": "Malware payload (SnakeKeylogger)", "value": "6f834464d5b2c643ab0616be0b1a9ff3cad52b19d3c7a175988ba3f9bfd816e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389441, "uuid": "8dc287f1-1549-4539-a281-f8fe5ee4f52b", "comment": "Malware payload (SnakeKeylogger)", "value": "a9d7773c63e9fc21e6e701b91419458d4a1555e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389441, "uuid": "07376e6c-2f27-4e8d-8d10-c74ae4211317", "comment": "Malware payload (SnakeKeylogger)", "value": "a2a4ac4175045d0a694055a79b52e34ecbbd61bcc026f1b12569a36581e70388546b12b05d61a4a08299999bc0e4f968", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389441, "uuid": "35b78d0a-0893-42bb-af16-1734164a99e6", "value": "AEE4026D07D81F05C8FEAF7066F2C14616B6B4469923E33E0DD825B6AE73BD0891D3A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389441, "uuid": "947da929-fef0-4255-b735-699cdffdd9cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389441, "uuid": "7ed0e99c-64f0-4b67-a225-71c43eafe625", "value": "12288:u0dZZxpMMxm+esc8akUew6MdD4Fa2Xp5JH3U45X4EhVEL2X0jWBi:XdZLpnxmJsc+4D4Fp55tUK4EhVEKX0jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620389441, "uuid": "330fe347-3fbe-417a-899a-2694663c0f5f", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620389441, "uuid": "54d05114-9ffc-4dcd-b048-a36c63861ea2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389441, "uuid": "14ac8263-1fcf-44b6-bf41-4e83ece6b5a0", "value": "FKYVh42iBV2lh5l.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0a698b-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620414050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414050, "uuid": "e395f82e-3054-4cab-a1c7-430b1f0fba45", "comment": "Malware payload (Dridex)", "value": "1f1a3ba35e2883b3647990770059520b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414050, "uuid": "c98399f3-80c0-4b99-813a-ead568fb1ae0", "comment": "Malware payload (Dridex)", "value": "6f9b00258b46c1b6bec306de15ae575405996a9ee7d7205750cefac2438dbb79", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414050, "uuid": "608f17c6-e8a2-44bb-a51a-0888a2c74f54", "comment": "Malware payload (Dridex)", "value": "b568e9d40d75fd71bdf5aa51ddc6de5a41f1e41f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414050, "uuid": "0878884e-ba79-4ad6-bd8d-2c8dcf92c273", "comment": "Malware payload (Dridex)", "value": "631feb09ca138bdecbc6bfe59a03a19af3badca7559d90a768a43e7e4b2d7166202e3b0798747e725044f0afc5737efc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414050, "uuid": "5c0988d1-be5a-4c99-b3a3-0bcfea9d2fa8", "value": "BAF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414050, "uuid": "47e6b604-e5d3-48b9-9acf-d12392cbf65b", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414050, "uuid": "e014ff5c-4100-423b-bd60-b19fb1a3c6b9", "value": "3072:ulpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ulo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414050, "uuid": "9f1a25f1-5a1e-495b-b1a6-58f0aed4fd09", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414050, "uuid": "3547dbcb-fcd3-4a64-b20d-926ac2afa8c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414050, "uuid": "22b6984a-9a9d-46dc-99ad-faa74744c28c", "value": "1f1a3ba3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2713dfc6-af25-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620385966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385966, "uuid": "420ed100-abb2-4cd5-b5f0-61f16f2f8354", "comment": "Malware payload", "value": "d4304bf0e2d870d9165b7a84f2b75870", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385966, "uuid": "d868c2ce-f119-4bf4-aa40-921049541f5e", "comment": "Malware payload", "value": "6fc5c0b09ee18143f0e7d17231f904a5b04a7bd2f5d3c2c7bfe1ef311f41a4d3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385966, "uuid": "67aa2e23-1573-4326-b423-50b0cf1b4188", "comment": "Malware payload", "value": "faba7be164ea0dbd4f51605dd4f22090df8a2fb4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385966, "uuid": "39b3b8d4-2d22-4f88-8bde-895094e4f51b", "comment": "Malware payload", "value": "43af36d6b319a8d8fc38debfc411d8d75598f771f32fe10e280f567f7c11575e98a886039e0cdf677b99a38d245059e5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385966, "uuid": "bbd2300a-3ad3-4fd7-b52d-79fe7a06c056", "value": "4083F187EAE54AB7C0B2D83D09E73695E6F6AD38145987625538184FBF2D380EC08377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385966, "uuid": "1b28ee99-deab-4d31-aabc-31022b1638d7", "value": "d609a88c9c1c0b83071e61f9c45f78d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385966, "uuid": "b760aaac-3a07-4525-a4a8-6d15b71fd61f", "value": "1536:s2qyK6nJjTpvWzt7p8AeAPJ2+Z814UZ0ga3JDhIH1hAHebN:lrTvWzt7p8AeUwAhqMlOhAyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385966, "uuid": "4515fca8-9e9d-49fa-8d60-b11dc545b15b", "value": 82314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385966, "uuid": "084623d6-51dd-43ab-8267-727ed26732e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385966, "uuid": "db5fef31-033b-4250-ad8c-89c4d2788c00", "value": "sunset1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714d93dc-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403700, "uuid": "bd4a49c4-98c6-4e0a-a2b9-2e37f93e0e8b", "comment": "Malware payload (Dridex)", "value": "430a30f8ef8f8668e1b896366c93d596", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403700, "uuid": "b8d7e10e-0a58-455e-8d02-a8187062b4bf", "comment": "Malware payload (Dridex)", "value": "7015b6708526f59fddfc51d7b8dce3cbf8ae5539e2b563c1a1a3e50c2f5c94e3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403700, "uuid": "d7128321-abee-4401-9904-a258e0b85fab", "comment": "Malware payload (Dridex)", "value": "1cb8e720183ffdc6b71de2b43cdf703e9fa99442", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403700, "uuid": "e534d725-378e-4963-9bb4-36d6dde4764b", "comment": "Malware payload (Dridex)", "value": "d52b7763839b4711cb462636a2f528652d225aca0b83687bd1c87f3b163efb78c413f506f0fb43ad7d3e11423b98893b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403700, "uuid": "e58d9483-5758-4d00-a25b-ae3ba01e59ea", "value": "1CF3D141C9C5CCF0CBE36C3A4795963B3624B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403700, "uuid": "f3d92b77-7f4c-4fe8-b622-fdc4ed39cd97", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403700, "uuid": "cd4cdae8-d9be-4bc1-b93f-18d7ec49e376", "value": "3072:ouFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+l9x:o0czbty9uiaJlA9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403700, "uuid": "3a75a52b-dba9-4bca-b2ea-d5d782681196", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403700, "uuid": "53774f84-6be5-44d5-8061-725453f82502", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403700, "uuid": "83761993-5f71-4fae-bfef-275e12ec26e4", "value": "430a30f8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b40b59b-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403717, "uuid": "3d422951-d64b-47d0-ac81-886bb9c9e445", "comment": "Malware payload (Dridex)", "value": "d730047af59a1fd39f8ed04ef553d178", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403717, "uuid": "51b98b52-8a96-46e8-8221-e50a30b0e853", "comment": "Malware payload (Dridex)", "value": "702a4be099c58a7d84da4a362784ff4acebc09a245260f8f5b55905689423769", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403717, "uuid": "d05a0d91-a166-4ec3-8bf0-bf07fb3cdc2b", "comment": "Malware payload (Dridex)", "value": "9c27cc4d3b90a8c3a86552120c5a208de22add11", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403717, "uuid": "f010b3aa-6ee3-4db4-93db-a9210448b29c", "comment": "Malware payload (Dridex)", "value": "e6b9ab1ca37ab9d7beba58c3af3f56e8d91819e96da6040f8c0bb02d6e80237b746679eef994ba0b70f7212196442515", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403717, "uuid": "ce3271f4-77f5-433e-8ffd-e92878fa7161", "value": "7CF3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABD95BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403717, "uuid": "ac49c92e-ef85-43f3-be42-27c26471ea42", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403717, "uuid": "e8acf866-451d-490b-b716-ad02a2c11bf6", "value": "3072:pBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHtZ:3uXLcclWEc2HeSjNjGdeNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403717, "uuid": "c4c66553-278f-45d1-b923-75b805ca00f6", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403717, "uuid": "a6821afe-85c5-418c-b6de-142d95cf59f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403717, "uuid": "0a131a8d-3a9a-4e94-9d63-d3b79c742af1", "value": "d730047a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227ba361-af02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620370926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370926, "uuid": "686e1e37-6900-4e44-836f-36939f0a3bb5", "comment": "Malware payload (Dridex)", "value": "76ab35f284418a10ea63ef52b621b887", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370926, "uuid": "6de389d5-f0cc-4b99-8bec-71665c2e5766", "comment": "Malware payload (Dridex)", "value": "7086d4721258d34e4a35df9e498e0410f48d62c4510a046744bfc17b2418e2fb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370926, "uuid": "65673cc5-8d6d-42f3-b0ee-552c9e977afe", "comment": "Malware payload (Dridex)", "value": "d19d0d9d7efe8a06b62081c76d87f9a02bb0a774", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370926, "uuid": "2d43b4eb-cd25-44bd-9d31-2cf0b61a64cb", "comment": "Malware payload (Dridex)", "value": "fa33c615da174816d6452c06f6f3fdea3217aebe8208972f47326751f47e97993ff7b3d749bc1ccb36bb4352b8044091", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370926, "uuid": "88498b40-f6f6-4bc2-8e58-5dd9fbbf3adb", "value": "09F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370926, "uuid": "40f6a3e5-cbf5-47cb-8d20-2f7da04eeb31", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370926, "uuid": "769117cd-7801-4588-88b2-dbed4fc963db", "value": "3072:rlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:rlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620370926, "uuid": "8acc9066-9f52-43de-b0c9-7e944bd77dce", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620370926, "uuid": "f73a6b1e-b093-4296-9216-2016779ceb88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370926, "uuid": "ca6948fb-2fe4-4eec-8938-d72bd5c31ca9", "value": "76ab35f2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14434d4b-af02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620370902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370902, "uuid": "dc416f7b-9a07-451f-8100-cbaa5abbf383", "comment": "Malware payload (Dridex)", "value": "6139ca1e41fe99de680662d08486ea08", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370902, "uuid": "5e0e7283-5325-4ce0-86f8-4578fe19fb4d", "comment": "Malware payload (Dridex)", "value": "7118aa9194bee6f560df37f44c7e33da94dc05815f8d00ad81fef7da3fb7c3b3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370902, "uuid": "0b3dd71d-6671-4419-b2c1-842308ad987e", "comment": "Malware payload (Dridex)", "value": "e4b98363d2fae6edd492684d41ba753ae3ce9a77", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370902, "uuid": "5c269a42-951a-41f3-b5f5-270d175e8d6f", "comment": "Malware payload (Dridex)", "value": "d3f1d0c7aae03845431c603eb362e49e091f5a32eed5abf6b24d1df1da1c4738b84b50ca5629370fa1cc3e47757fe9ec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370902, "uuid": "76499890-7afa-4199-ba33-4bf2aa664f49", "value": "7DF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370902, "uuid": "a13db27a-97f3-49fe-86b1-acaa4c3c8226", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370902, "uuid": "7765fc71-1b07-4e3a-984b-e3dcab1ab39f", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620370902, "uuid": "4e2d12b0-c579-4a4a-8035-c470673dbc7c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620370902, "uuid": "f481d6b7-3ebe-43c0-96bd-1492f934cd39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370902, "uuid": "deab4061-35ff-4f5c-b318-ca0b7b630cbc", "value": "6139ca1e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc6c8e2-af48-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620400982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400982, "uuid": "d2d4107f-b0c4-4033-96b5-f6748bd79113", "comment": "Malware payload (Dridex)", "value": "c1d1e95f5b0220672f6ec435cd63ab71", "object_relation": "md5", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400982, "uuid": "7105faee-7b8e-44e5-a716-66747bf11af0", "comment": "Malware payload (Dridex)", "value": "7139ded23a4242b4c8e4b71428384d2b82c4f93b0dba2ab244b0bce282c1707e", "object_relation": "sha256", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400982, "uuid": "5e101621-f417-4e8e-9879-2f81da7fe0fe", "comment": "Malware payload (Dridex)", "value": "5548784998d197d64c1837aab77a67fd7ba68978", "object_relation": "sha1", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400982, "uuid": "55520693-2e37-489e-afbd-8b0531aeb0af", "comment": "Malware payload (Dridex)", "value": "a4083f6f7841049bff41aaf0e7995084d16a7145d8b85bd073acd81bbd299cc3b77e687583be903228a9995bc102787b", "object_relation": "sha3-384", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400982, "uuid": "b35a92fd-dd1a-400c-a8d9-9767209b2afb", "value": "E0240299C4E6F56BCBF3283A46C96FB32977659141F3AC1CB51AF73CA248E0364510CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400982, "uuid": "8ec71f08-6ae8-4f81-9717-b60dc338cb6b", "value": "6144:Ew3IO+/ENhLv5xyGBVeJZnC469axilrxDMP:Ew3n+crRBjeJZ369KYrx4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620400982, "uuid": "8a184bba-67b7-480b-b21d-1bb28718b966", "value": 225136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620400982, "uuid": "4508282b-69a1-4669-afa8-5900d9fa6ca8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400982, "uuid": "5d1b755b-58ee-407c-a81c-2a45c30395d4", "value": "document 23513.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c148b865-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403835, "uuid": "e16e53b9-ef00-4bb3-92fc-72e6bfa96fde", "comment": "Malware payload (Dridex)", "value": "df248aa0c89f4258e36a541e51a2fc83", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403835, "uuid": "b788458f-88f7-4a81-bb7c-95a1d927d3e0", "comment": "Malware payload (Dridex)", "value": "7145d099ce2cf9fbf7d48062bff69f01828ebe7dd44649a7b44ab1e832b4e966", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403835, "uuid": "f370ec43-e294-4c3e-aa59-45e76ac821d3", "comment": "Malware payload (Dridex)", "value": "9a1f08b1d7d62ed8b3cd84de92c54905e309ef98", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403835, "uuid": "ef807db9-fbf7-49f6-b84e-3f5b60ec2632", "comment": "Malware payload (Dridex)", "value": "abafec4ce0fbaafb010b4c2f54d45b379c1dce1a22f4a4bb1f5e954aa399f0714cb30dd6dbee251db738fdcf4331e216", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403835, "uuid": "1eae6ee2-b985-49e6-980f-f97832881c48", "value": "89F3D081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403835, "uuid": "34c1a1ba-d5f1-4006-a0ab-edf15d42637f", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403835, "uuid": "d9f1eed9-9abc-487d-8525-48d8cb0f1afa", "value": "3072:oBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHcY:suXLcclWEc2HeSjNjGde8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403835, "uuid": "b124a31f-a0a7-4288-ad1e-929724ae2bfa", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403835, "uuid": "5831ee68-c0c6-4963-8d95-6399cce156a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403835, "uuid": "52d69909-064b-4b5c-9ab4-c628efea8896", "value": "df248aa0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c55cdf9-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403746, "uuid": "f6e7fd8f-843f-4092-b94b-a4bb4a5ad9cc", "comment": "Malware payload (Dridex)", "value": "970f4caaf5be4e17f18c39573109d4d1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403746, "uuid": "d8e4b635-9302-4035-8c99-bc7e10097ace", "comment": "Malware payload (Dridex)", "value": "715415471fd36226ff6d0d6741561b466bcb7f5d10d786c9527533f3c5470fb8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403746, "uuid": "892547b6-c868-45ff-9acc-d95e2d2e5dd1", "comment": "Malware payload (Dridex)", "value": "13a1e2b6a83cf17ce6c5dfef24cbc44b981ae243", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403746, "uuid": "4d7e212c-68a7-4750-a549-1e8bfc1fe772", "comment": "Malware payload (Dridex)", "value": "ae2c4f0b724c4d7a1b7e578c026f54b4c05ca7b51dcbeadc5f0b4b19d187cd22f3088d54b3bdeea1383030ceac110666", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403746, "uuid": "15b529cf-5198-4f38-bbc0-08c12a45c01c", "value": "37F3D081E78ED5E0FC075B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403746, "uuid": "925b8d6e-f1c4-4bea-b672-2a167e0797f4", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403746, "uuid": "58f09a59-2b6d-4571-96ca-89eb035c2aec", "value": "3072:lBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHN5:LuXLcclWEc2HeSjNjGdet5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403746, "uuid": "f518eb83-4029-4e67-912c-44552ea5b913", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403746, "uuid": "6937e5aa-8d35-4903-8eb4-b84c851cda36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403746, "uuid": "31761883-bcc2-4379-9db9-a6edd88b42c6", "value": "970f4caa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3497aaa5-af19-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620380835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620380835, "uuid": "e588fd3a-e172-470f-bf7a-d3b9274f801d", "comment": "Malware payload (AgentTesla)", "value": "b0ad36a42d0195f6cf35c7371dbb3599", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620380835, "uuid": "a16da587-a382-47a3-8ac2-4ee42c324f30", "comment": "Malware payload (AgentTesla)", "value": "71bcd3fb46e8f1730b2ec5000939142f1bf4a14a317e16b7163fb239f9209a36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620380835, "uuid": "7de2eb59-16ac-47ea-b386-2cd5cffe00cb", "comment": "Malware payload (AgentTesla)", "value": "152eb56b2f0200d7478ce978095f8c84b81ae0db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620380835, "uuid": "8408a897-4b10-4a13-a9df-046640671143", "comment": "Malware payload (AgentTesla)", "value": "b591e5da7f788e337153af62eb5e86521e8d7bf7ae10ce42f889b97018422d1f77710bf0c7ee8c34c2695dea05a5f54d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620380835, "uuid": "d992bfa9-5f59-47a6-9f2d-65681282167c", "value": "5FD4E3E29521CC54CB87B334B2C8C84ADF207D4C8729AB9D2C677C8636AA9541DF7379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620380835, "uuid": "544072f4-5bf0-4f53-b611-f1cf3731c212", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620380835, "uuid": "873308f0-9cc7-4092-be28-2b0f062571ff", "value": "6144:bcjFwnIEATjSGCY+0ybzUcxEU3ZvRgkFSMJi+VQ5E10JcaUEOs:bcp0IEA5C90yUDgRHdp1041", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620380835, "uuid": "56039327-a359-4ca0-a2f2-d2af2af41bbc", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620380835, "uuid": "f4094000-e8d7-4002-9c8c-1c9145b4c860", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620380835, "uuid": "48f4070b-cf7f-44da-a909-91fc9de8ca7d", "value": "MT103P53665636.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a7ef4d-af12-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620377849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377849, "uuid": "8df20528-99de-4e39-af34-a35be7533a5c", "comment": "Malware payload", "value": "aede2279e9119fb59a149df05eebc033", "object_relation": "md5", "Tag": [ { "name": "TA551_Shathak", "colour": "#65AF79", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377849, "uuid": "ca282b36-93fe-4f90-b840-7dad8e220857", "comment": "Malware payload", "value": "71d43c3bd77297b86d32742576c043f274ff9becd515f4f477e56daa642ec92d", "object_relation": "sha256", "Tag": [ { "name": "TA551_Shathak", "colour": "#65AF79", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377849, "uuid": "7274da5c-6c9f-4efe-8e22-411498bbc51b", "comment": "Malware payload", "value": "63876f641ae31b27eb0358cbaa27d3d209d85846", "object_relation": "sha1", "Tag": [ { "name": "TA551_Shathak", "colour": "#65AF79", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377849, "uuid": "157e6077-4697-4030-b43b-cabf4ee23404", "comment": "Malware payload", "value": "2215528ef9562c01ba1e983f6ff3d99c844839f2b37a1a1db3bb339e8a8c6bff31165a4e4e8fcb598206fe50f0e57346", "object_relation": "sha3-384", "Tag": [ { "name": "TA551_Shathak", "colour": "#65AF79", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377849, "uuid": "2d1c8238-1f06-4d2c-a54c-c5518d4c8285", "value": "C5833821AB6A9BD0EDCA79371651CAB1D3324FC0170377EBBEAC7B4D2758981482512F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377849, "uuid": "24d34098-4849-403b-8abd-d5e9b96858d4", "value": "1536:aYhKiB01bTDkNnhipFnY5IE2vYjsRX7oV:LKi+3DMInY54vYjsRX7oV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620377849, "uuid": "6c565c1e-4c3d-44b6-bb7b-fa97226b793e", "value": 81603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620377849, "uuid": "110eb231-d572-4ef6-9e64-64a01cfa2b79", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377849, "uuid": "8ee3a64d-e3c5-4508-b970-a767d44b1379", "value": "particulars 05.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bde92d6-af44-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620399343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399343, "uuid": "1cad84fe-9199-4fff-96e9-faa1f00f3fd0", "comment": "Malware payload (ArkeiStealer)", "value": "e10cec8d94d1e940cf51ee0c6e210d8d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399343, "uuid": "89ef600c-e0f7-4772-9706-e2a0e6831947", "comment": "Malware payload (ArkeiStealer)", "value": "7206113b61061f175d78f0ff5f8e2d33c1b18aaf73c5890ad55f94492c29cb90", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399343, "uuid": "52a5c87d-77c1-4d6b-979b-96153bca2b7b", "comment": "Malware payload (ArkeiStealer)", "value": "423473c1867ce1dd0d3a66cae7c39704a5fb01b7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399343, "uuid": "e5d8bc11-67f7-44a3-890d-e3e661c0ec6b", "comment": "Malware payload (ArkeiStealer)", "value": "eb7729d5405a40c6d426e1df151b8a21d35ffcb9d6f6858015d8f7030d8d1577bb57f828d4c9c2d3df5d2a53d04d0adc", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399343, "uuid": "c37f6e2a-757c-49a2-abf6-df6c90c27831", "value": "DED4E130AA40C034E4F716F849FB927DA52D7AA16B2450CF12D82AEED6346F5BD31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399343, "uuid": "65c55da9-648f-48eb-892a-0923812e8d23", "value": "c5944944647f897dc99e9f24f2d785cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399343, "uuid": "09e941ca-b058-489d-8466-4e36e5231e69", "value": "12288:WBveOJ/9vmECPy1OB45ec7nZJsAzHxzkaBpHJT:hy/BbOBcec73sAhkupp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620399343, "uuid": "3a214e77-10da-453b-854a-50f4f5a60252", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620399343, "uuid": "525ca65c-ce2b-454a-abe0-390877b09626", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399343, "uuid": "ac8c7698-f324-4e95-8a7a-244260179139", "value": "e10cec8d94d1e940cf51ee0c6e210d8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8ecd6a-af38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620394376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394376, "uuid": "8e900224-f565-4140-9676-e1ea24e04b0f", "comment": "Malware payload (Mirai)", "value": "0512f67d5949c9cba0fefca257f78653", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394376, "uuid": "db00d2bd-f7c9-4b0f-a9fa-6b96daefa94c", "comment": "Malware payload (Mirai)", "value": "73011ada22e8e14a6e0a5f6f57bbe9c1fa5cf65c9c2a748bd6fa3f551af33cc3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394376, "uuid": "6f73a2bf-2ab8-42dc-bf90-473e0bcb5243", "comment": "Malware payload (Mirai)", "value": "75038785824812f67366ddda38a2e2b383bbbd95", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394376, "uuid": "8c84ae68-6902-479d-844c-0a0b5a54f44f", "comment": "Malware payload (Mirai)", "value": "92c53c46b5703c33d40bfcaf62a69ca9ba46f67e1a9a530f4692847bb246cc1b7dcafe4cdd019689b64a8bd0e3f7843d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394376, "uuid": "a8c5f8d0-1f53-444d-b4d6-7015c7a3a871", "value": "C6B3B60D2E358F7DF7AE827587F78E209648339536E5C649E15CFD021EB0249342BBA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394376, "uuid": "84cb7eab-217c-48a7-b6dd-17ea7fb144ac", "value": "3072:Z/dOmx+I/gWwhtmHjQiE/dJmvuz5UidJ5f/bnbuK:HOmoI/8mDvuz5LzfTKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620394376, "uuid": "e65c31a7-650e-41d9-a100-845ec950b440", "value": 109880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620394376, "uuid": "88882c24-f450-4d75-ad81-bfd20c168c69", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394376, "uuid": "a9933a76-7906-4265-bec2-5116906887dd", "value": "bo(1).mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c704cb12-af35-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620393107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393107, "uuid": "7d82df64-aabc-4318-a47e-1f97c0357037", "comment": "Malware payload (Mirai)", "value": "b7b87a15a070213fe54be8077517b7d1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393107, "uuid": "c5f46068-57f3-49ce-a6f0-964acbd0b477", "comment": "Malware payload (Mirai)", "value": "730cab7cdd6e149c2fd57e3005e400a31cb0c350ea3824537be0aa297a1fddc5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393107, "uuid": "75e57b69-31f5-40ac-81fe-75dbfc1c51b5", "comment": "Malware payload (Mirai)", "value": "4a4e4320dff3ae2a9e896a23dd52002624e880df", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393107, "uuid": "ea352558-d30a-40a8-a919-094ac25b593c", "comment": "Malware payload (Mirai)", "value": "5999f6434b0a411b5d2925ab3af9b3963332286b459e5c833acbe72e01aba461f9f6ee7ed8b3ec00addbc86a37890390", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393107, "uuid": "2e5f40a7-fd21-4afb-98d1-f268bbb64135", "value": "6A535921AD792E17C1ECA17A52F38364B2F51B4E25B48B2E7C360E8EFF4154866132F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393107, "uuid": "a730d5b9-849a-4a18-9e0e-5731a30fd514", "value": "768:/73a4+o5oo+p6OP5frl15mOL7UopMkArTVXajO+WxKSnNSGx:j3t+o5L+p6OP5frv5mOvM7NaXeLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393107, "uuid": "ea7294a7-e52f-4f12-80f0-57fee4d71d97", "value": 63476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393107, "uuid": "63bbd0bc-a669-401f-b172-dce7c25b74e3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393107, "uuid": "e76fe9f1-4c2f-43b0-b56d-b1078711c98d", "value": "apep.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af78803-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403529, "uuid": "33ce825c-1b3e-4a73-94b0-f72c2291d5e8", "comment": "Malware payload (Dridex)", "value": "3a4b825d47e7e48a4c686c2efdd00443", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403529, "uuid": "0177e662-6423-4a52-925a-97a1cd25c3d2", "comment": "Malware payload (Dridex)", "value": "736784ce9cad3bfff8bbced568895335d844848d26d84e9e8658c041cb350e04", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403529, "uuid": "4ec77d1c-8ae6-47e8-a5df-75fd2bb633eb", "comment": "Malware payload (Dridex)", "value": "d30d192a18fce0a95a3c0936933ba7eeb0d9dd2e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403529, "uuid": "186b8135-78cf-4e07-a8c0-58d3ad140101", "comment": "Malware payload (Dridex)", "value": "32276d8e0daa5dd405cc35ee713110d825b82a46f40fa5a5be2ca21aca7f42d85dd562b10e56f7cec765c1667fe26a50", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403529, "uuid": "ad7f3061-a25c-4b9e-9be4-1c213797f336", "value": "E7F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403529, "uuid": "8b884cbb-a769-407f-98e5-da1ae97f0bb1", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403529, "uuid": "cade8e6c-e1b5-4dfd-b175-f315a0e4de21", "value": "3072:EBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHWh:guXLcclWEc2HeSjNjGde2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403529, "uuid": "4b2c0a5d-cf56-4d47-a8ff-00ace9454933", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403529, "uuid": "2dcb06d7-3a16-43c5-8462-079486eef8ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403529, "uuid": "002f6741-8aeb-4313-a741-fab005a5d184", "value": "3a4b825d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55062c93-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404082, "uuid": "2190f252-53b2-4045-8df6-3c620696ad4b", "comment": "Malware payload (Dridex)", "value": "7e194e56d46611131d81bc694f4ceac0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404082, "uuid": "daa595cb-2bae-4a20-aa80-ddcddd6d291e", "comment": "Malware payload (Dridex)", "value": "739dd114c4ecf80c95ff4ea046f2e235be986a89db4436492ccdc5ff6eddc351", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404082, "uuid": "bdbcfac6-678a-42ba-bd83-18d7313c99ef", "comment": "Malware payload (Dridex)", "value": "015ec64b531cca64b2222bd7fa903141e88ed4d3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404082, "uuid": "544abe2a-e30f-49f5-8d9b-58457997b777", "comment": "Malware payload (Dridex)", "value": "604b353a5afcd471ad5ffca8c0836cb9672e508a62195d0cdc3591cbb071ac4fb7cfeaa9d6ff7c8691102d7a712eb107", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404082, "uuid": "f57d9592-27ed-42dc-96fd-77510c5cefd1", "value": "7CF3D081E7CED5E0FC179B323EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404082, "uuid": "860c60c6-c548-47d7-b2e3-41ee9db63e86", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404082, "uuid": "e9694d58-4ea5-4aa7-b11f-a42a3e70aaac", "value": "3072:EBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHaH:guXLcclWEc2HeSjNjGde6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404082, "uuid": "efe27ec5-a6b3-4439-b28c-805de105ac7d", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404082, "uuid": "82ce1b97-5ef6-4fbd-8361-c887375134a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404082, "uuid": "2e129d4b-8dd1-4081-b0ac-e03ba77f70c6", "value": "7e194e56_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082a87db-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403953, "uuid": "bafdf23a-6034-4b7d-acc9-ae9a9ea33a8c", "comment": "Malware payload (Dridex)", "value": "c7dfb6b4820432e19c4aeee17571bcea", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403953, "uuid": "c517bd0e-f385-4d0c-8378-4fc936ce327b", "comment": "Malware payload (Dridex)", "value": "73d438481f59d7d736c16fb05bb7691cd9cb35189e9fbac9fd0684694c65b139", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403953, "uuid": "a849c2e7-7811-4216-ae26-47781529fe79", "comment": "Malware payload (Dridex)", "value": "1c2748df43e63e81244dda8dd24467ac69271b57", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403953, "uuid": "dc90da0f-1032-45b5-966d-252042aaa06f", "comment": "Malware payload (Dridex)", "value": "576003da8074f5aa2a7875907caf64bff9bbe71ec3ebc4583c65d9745b68727da933a7874bf2cf8fd19c3710bdd4680f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403953, "uuid": "16dee62a-b983-4511-9fff-d77b588e10b4", "value": "05F3C141C9C5CCF0CBE36C3A4695963B3628B941995A8E42EC24CE3F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403953, "uuid": "98fc4036-35a4-4cec-a564-3fe7916e6699", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403953, "uuid": "7b996f65-b086-440c-8b84-5713baa0ab08", "value": "3072:uuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+3n:u0czbty9uiaJlWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403953, "uuid": "adfd4617-2852-49ec-aa0f-c5b8d4771819", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403953, "uuid": "d8b54f39-53cf-4064-a24d-cd1003af9dca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403953, "uuid": "a5cc5a1a-2686-494d-9f3e-2e336a8fb4a0", "value": "c7dfb6b4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee32f4f4-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407346, "uuid": "c66a5411-d9bf-404a-90de-4f367d199ad6", "comment": "Malware payload (Dridex)", "value": "b69b25922aeb5c0b433d972a67a28eed", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407346, "uuid": "b4b1d08c-3620-4b5f-a14f-5d91e26d044a", "comment": "Malware payload (Dridex)", "value": "73ff2200173c0ae040580dbd691fb90fe1b78864691dc74b735de412751c8d0c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407346, "uuid": "0e56005d-1f3d-4ebb-9b8d-3bee6babccec", "comment": "Malware payload (Dridex)", "value": "2b5b04809ae759846b48053ce7d481c5224405c1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407346, "uuid": "23acee5f-0053-49ff-b5aa-ee71d5108ae7", "comment": "Malware payload (Dridex)", "value": "fcc41141ca5939c3c965db126feb709b677346a2df8b9f37c982fbbd73ebf1e6dd552ef9bb33a7fcdbf8d04378492fcb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407346, "uuid": "2a3469e3-6bce-45dc-a033-24cc9c4e6d35", "value": "99F3D081E7CED5E0FC079B333EA80EEF52310087691854E4EF29DABD96BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407346, "uuid": "5cfff336-0cce-4e95-8ad9-1ab5829ba961", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407346, "uuid": "d045d126-dd27-4dd1-8d2e-66a4bc58445c", "value": "3072:RBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHit:PuXLcclWEc2HeSjNjGdeCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407346, "uuid": "35c76c3a-4e48-4d3b-b5fa-7066e744e2e2", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407346, "uuid": "30cd2655-984f-46da-ad5d-8e3a3ebba439", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407346, "uuid": "2e52a1f3-df43-49b4-a2cc-9747b9e79098", "value": "b69b2592_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d8ce1d-af5e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620410553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410553, "uuid": "ca6d44d8-1dc6-4e88-8785-82a479086c18", "comment": "Malware payload (Dridex)", "value": "fe0c30e25ef465346a34406396103894", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410553, "uuid": "98bcfb02-16ae-4bfb-b0c6-6db918baec29", "comment": "Malware payload (Dridex)", "value": "74316e4a4b54fc29b304fe8b7283d2267d10a87e282f47ba3dc2612dccc7c360", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410553, "uuid": "f75b04a5-17cd-4640-982c-44d342f88ca5", "comment": "Malware payload (Dridex)", "value": "17a932c21b122a501f19c3b35298a898bd3f619f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410553, "uuid": "1a6fa1bf-aedc-4039-a7d7-c7ba77abfba2", "comment": "Malware payload (Dridex)", "value": "6610cad9200f6c8d175f1079a279afe3a8196448a06adbf71001a4079d45f549926ac88f1487f0b625b1779b56f7362f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410553, "uuid": "cdac5856-25a4-46d4-9dcb-25f71cdab7f9", "value": "64F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410553, "uuid": "496c1dc6-c247-4a0d-8b44-39c8e833d03b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410553, "uuid": "7630fa07-ffb8-468b-9d94-2b3b09ff7981", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620410553, "uuid": "93f05e07-fa0d-4184-aac2-bd08726f3792", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620410553, "uuid": "95c506ee-1aa4-4628-bcd4-85c0acb1877b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410553, "uuid": "c792e01d-6eb4-48c9-b169-725d0b10f6ba", "value": "fe0c30e2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc760d68-af8f-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620431744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620431744, "uuid": "21c0ee16-2b08-4c6f-acaa-b4fe2fd875db", "comment": "Malware payload (ArkeiStealer)", "value": "fb010c7707c22e214f000fb77e556a46", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620431744, "uuid": "3fa02a04-95dc-4daa-871c-fa7a652b6232", "comment": "Malware payload (ArkeiStealer)", "value": "744e44a26db2338bb948931f4ea5e6dc88bb082feeea82609c33c15fe2f1e139", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620431744, "uuid": "39cbddb1-ac0a-4e8c-b677-0fb561d5e657", "comment": "Malware payload (ArkeiStealer)", "value": "dbf3699f48f14ecbc8f34635ca8195ae888cf6d5", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620431744, "uuid": "635d49cc-87eb-46aa-b011-d231ab15f86a", "comment": "Malware payload (ArkeiStealer)", "value": "b15e7b64a99aceee4cc271a8312a40b99e7e7dab9b615bc97a7dc40a0c19158926f86a9818202d0f79425dd65f41118e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620431744, "uuid": "36ccc57f-fae6-459d-836c-4b438d13b413", "value": "42E4F122B580D072CC651E394065CB749EABBC335F215E8B96CD27B9EF207E17B2534A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620431744, "uuid": "4ad3e37f-1803-455c-9612-93b737feff25", "value": "e5eddde3bc28318303bde004dece8436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620431744, "uuid": "55afbb1c-fafd-45d1-99c7-68afd6913c4e", "value": "12288:9gNj+oU6kMCMnI5Ndaf32INMSGavd4OiIMAYyDiwqojVJLmUx:9gNj+oUPT5Ds2Cv4W/tWwqoWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620431744, "uuid": "6c52162d-b455-485b-8216-113f973a6377", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620431744, "uuid": "09e68bf4-2b0d-4810-9c4a-00ff67ddccbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620431744, "uuid": "49906d72-2029-45f3-ab00-8e8ce54217b6", "value": "fb010c7707c22e214f000fb77e556a46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcb7a2d-af7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620424847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424847, "uuid": "c9ddd5f8-54e4-47ef-830a-cfbcef7d591f", "comment": "Malware payload (Dridex)", "value": "19e97901e02bc76170e3f8a16fd601f1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424847, "uuid": "8193c2ed-78fa-4152-b8aa-e67932507bf7", "comment": "Malware payload (Dridex)", "value": "7452d272588c64b9af9347e6c746bc9c9a9ab385e7b6fcbb50d5ccc666077a77", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424847, "uuid": "8cdc6c39-1dfa-420b-8126-b9a0ce44af6f", "comment": "Malware payload (Dridex)", "value": "89b26684d39fbc4d8ef62532ce4759c3cd877d13", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424847, "uuid": "76ffd3f0-b9d7-468f-ae6e-cc937a1b6d24", "comment": "Malware payload (Dridex)", "value": "e73cec68314171983ab49f553136f58aabd9d2fbfb9120b2cdb66025512fe109fd090b21c60b225df513291fdf364885", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424847, "uuid": "f4cf5960-b2f4-419c-8eb5-8aaaca3a8245", "value": "A0F3C141C9C5CCF0CBE36C3A4695963B3228B541995A8E42EC64CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424847, "uuid": "56da64f9-f800-4e74-b5d7-93788d5db434", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424847, "uuid": "50630287-811c-4258-b242-3fb828b12e2d", "value": "3072:uuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+HY:u0czbty9uiaJlOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620424847, "uuid": "d5c7afa8-f99c-4392-86ae-d54a5899e128", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620424847, "uuid": "8be6c5a1-4956-4039-9145-f10934f37998", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424847, "uuid": "f51877e8-efab-45f4-987e-8bc4b9472e7a", "value": "19e97901_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65e90fa-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403467, "uuid": "21d6d6ca-a8a3-4da0-aff4-5a4ecf9d87da", "comment": "Malware payload (Dridex)", "value": "486ed1d51ad0bc21bb4257618bf51c3b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403467, "uuid": "388c897f-f84a-49ad-b181-4cd1f1cbc265", "comment": "Malware payload (Dridex)", "value": "74642d316b69c4001a42411798a794679beb690200603b3cb4765ae08ec7ab71", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403467, "uuid": "b1dd77c1-a532-4f9e-ac9b-e47150e99a43", "comment": "Malware payload (Dridex)", "value": "2f17622e646a61a982adacedf13d67f1c0810a7c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403467, "uuid": "b0bdd952-b1ec-4303-b0c2-f60af05aba78", "comment": "Malware payload (Dridex)", "value": "f3b7bde8e62a09d2a44c29f79b212201cfa13c66725245d7697db8b7825915fa89007a4725533c407d0f7224838d7259", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403467, "uuid": "f25b8a5f-1c3d-4537-a3ef-8dccaf6902e3", "value": "BFF3D141C9C5CCF0CBF36C3A4695963B3228B941995A8E42EC24CE2F615F3F1F95A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403467, "uuid": "6805aa41-ee2e-4651-9f35-04a27b3cd50d", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403467, "uuid": "8aab1eb8-496e-40d3-8d67-7459a5833d7b", "value": "3072:euFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+3l:e0czbty9uiaJlCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403467, "uuid": "ea52787c-fb5f-480d-9fa6-888466a5c104", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403467, "uuid": "29ffa4d7-8ecc-465a-b0fb-3d1708226083", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403467, "uuid": "2288f794-3ac3-4837-8085-aef0038e9984", "value": "486ed1d5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528b2e7e-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404078, "uuid": "39a831e5-9edb-4135-a71a-d4bfce239e62", "comment": "Malware payload (Dridex)", "value": "f7ad34a65845a978a5c1c558886166c1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404078, "uuid": "654f7229-f4dd-4817-a3b9-60af1838fc04", "comment": "Malware payload (Dridex)", "value": "74953a4358d34159aa853335dd98bbbfa4e38adb9212cdf60d9beb62e62593f3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404078, "uuid": "7bfbf598-ca40-4a63-ac2e-d752a58002b2", "comment": "Malware payload (Dridex)", "value": "8eef52a8ff7b0c77d2115b999c23f9fb4d03d18d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404078, "uuid": "b0573934-e043-469e-936b-34a4031225c1", "comment": "Malware payload (Dridex)", "value": "f360d7eec4aea57150d7cd21544e4882aa1f7b3b6603a0cea1c09e336acc2a5144af43b8fe65989becbb8a43fc9bd82c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404078, "uuid": "90fab126-435b-425f-ba23-445b8baf68ac", "value": "21F3D141C9C5CCE0CBF36C3A4795963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404078, "uuid": "dca6d561-83c4-4c95-9e89-0f8bc92a9825", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404078, "uuid": "cc11881e-e7da-4a91-8e18-3c564a41de5a", "value": "3072:/uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+zG:/0czbty9uiaJlyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404078, "uuid": "34726c37-6271-4a65-a9db-741551bacef4", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404078, "uuid": "9529e305-abf4-4133-88cf-f1d702b389bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404078, "uuid": "074046ec-f142-4539-83ec-f5f0b929157b", "value": "f7ad34a6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463a64ef-aef1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620363685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363685, "uuid": "9a1aefc3-b2ac-4f39-bcd5-eac90f033815", "comment": "Malware payload (Dridex)", "value": "9d30534680e4e983304ac14d4eddb3a9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363685, "uuid": "5e70ec21-037b-40f6-889d-4737517503a0", "comment": "Malware payload (Dridex)", "value": "75174c24c2428a91776f112fa08cc8d4481a65339ca400d930248431a7e2974b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363685, "uuid": "73676454-036f-4a7b-84cc-ddf9e850d322", "comment": "Malware payload (Dridex)", "value": "94da0c347245504ddf46aa8981b9bea0c4135528", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363685, "uuid": "572a98ea-aa0c-40d8-bcb2-1c042f6322ee", "comment": "Malware payload (Dridex)", "value": "6d959f8aa2e6d3fc1a1937e989be867ec84d68da7bb19d31ad98264bed9ebca242762eedf4d96666236a317d708538f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363685, "uuid": "31e23d9e-4e18-4e96-8a3a-ae2180fd38ea", "value": "22F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363685, "uuid": "cc50747f-bc63-4eee-894a-0c03c389e898", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363685, "uuid": "33173510-ab30-4347-ba11-1ff04e836c44", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620363685, "uuid": "323dffed-75ca-49d0-9e7c-7b69839ceea0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620363685, "uuid": "473dbf6f-ec81-4823-a334-d159bfa78bdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363685, "uuid": "34ee1cbc-e066-4109-b62e-ff3e3b3b06b3", "value": "9d305346_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe86678-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403477, "uuid": "276a5026-46eb-4771-9700-60f6b792c932", "comment": "Malware payload (Dridex)", "value": "bdd3085fc3b554ed76d1f55f157ec5bc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403477, "uuid": "d2e322b9-570d-4089-9f51-07d715ba4c42", "comment": "Malware payload (Dridex)", "value": "7528e4385b5023adf96d70ba2cd77651da951e2693a0ee65a7d5944f21c3aa6b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403477, "uuid": "51577a18-8f28-4368-b553-fdf7b86fe92c", "comment": "Malware payload (Dridex)", "value": "c6316380ada7ac8973e38d2a486624cd55c24b3c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403477, "uuid": "5f0bd8cc-d8b1-4c63-a913-c19e0f22924c", "comment": "Malware payload (Dridex)", "value": "84b5c813c6cf51a2907e0b8471f30fdfa31163e7badf11e67aea1a4db05fc020fefd989b9a44b55d7bd0ae55c420ba01", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403477, "uuid": "bde624e8-e96b-42e7-91ad-ec22cf37e35c", "value": "0FF3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABD96BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403477, "uuid": "a3fe3088-7641-41e1-8d5f-842e8d2c1185", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403477, "uuid": "6aba2d92-77e6-4d6a-857d-25a15ea0560f", "value": "3072:0BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHuB:wuXLcclWEc2HeSjNjGdeOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403477, "uuid": "766f5481-5f0c-40d8-bb23-06b63e1c8077", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403477, "uuid": "39c0286e-612e-4eac-ac36-1c9a9cd370fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403477, "uuid": "ab1842dd-524b-4565-a2b2-9de57652dd4e", "value": "bdd3085f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcc9bf3-af02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620370888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370888, "uuid": "4194acef-7add-4f37-90b9-9ed481ed09f3", "comment": "Malware payload (Dridex)", "value": "dc69eb12cb92b792bb39286a91610cea", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370888, "uuid": "9c51059a-cf25-4697-9a1c-20c31e15ed43", "comment": "Malware payload (Dridex)", "value": "753c595b14413f6ea053ab8a639d08407713ea72aad187d12e61465415176c94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370888, "uuid": "24cb60df-8574-4f14-8575-02d9cc20ce92", "comment": "Malware payload (Dridex)", "value": "685764deb037253e66d2d45bbf0e8441d420faaf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370888, "uuid": "6d5d26a4-3284-4aae-8b0c-c7e7ac063694", "comment": "Malware payload (Dridex)", "value": "788b11ac5db8e3705e64b2938b320f286601b81af5fc268d8a8bf29ef183025b96f9140c5a37675d5d78dfb21df101b3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370888, "uuid": "cbbca57d-4f34-48c3-a07f-162a7cb7cd40", "value": "89F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370888, "uuid": "140c356e-d159-4b99-a1f4-15533f6a710e", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370888, "uuid": "4cdc7396-52ca-49a0-a03f-b70e806bf7f1", "value": "3072:DiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:geAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620370888, "uuid": "59ed7f1e-02a6-4a24-8f2d-c23dc098c547", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620370888, "uuid": "56c8179f-5549-496c-a919-64679b2e2493", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370888, "uuid": "d64ec2b2-f4b5-4ae9-ac85-8202c21cd4fa", "value": "dc69eb12_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da7c238-af12-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620377871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377871, "uuid": "02611d26-208e-44b4-845c-16b198e436a6", "comment": "Malware payload", "value": "db322f9245fcc0e73b7a3f2051cee1ee", "object_relation": "md5", "Tag": [ { "name": "TA551_Shathak", "colour": "#65AF79", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377871, "uuid": "88744593-237a-45f3-b420-bd8a0dfdc909", "comment": "Malware payload", "value": "75a5921dc7fb28a61912f98834d891a7e773a22d9c33b2b224ad79554e12519f", "object_relation": "sha256", "Tag": [ { "name": "TA551_Shathak", "colour": "#65AF79", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377871, "uuid": "d097cede-fdff-4357-aa4f-151ff53868d2", "comment": "Malware payload", "value": "a5a05319717f9a533ef153aa38ebda3f9ffd8ac8", "object_relation": "sha1", "Tag": [ { "name": "TA551_Shathak", "colour": "#65AF79", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377871, "uuid": "1052da52-d53a-4972-9d26-08758d3babcd", "comment": "Malware payload", "value": "7f05e66bb26f132c08e7c89d0a0c83b9a15922eac3f741cddbecc5b967cab046bad06822350083efe47e4020f164d379", "object_relation": "sha3-384", "Tag": [ { "name": "TA551_Shathak", "colour": "#65AF79", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377871, "uuid": "e114359f-77e9-45c2-9dbf-3de6e14c2637", "value": "EC734821AB6A9BD4ECCA79770355CAB1D3324F80074373E7FE6CB64D2B68981482516F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377871, "uuid": "eb56e74e-553c-458c-b21e-d64bb8a70785", "value": "1536:Pa63J3Q1bTDkNnhipFnY5IE2vYjsRW8yx:PV3W3DMInY54vYjsREx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620377871, "uuid": "895e43c0-5633-4dfb-91f9-e30d502c355e", "value": 80703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620377871, "uuid": "97b8eb19-d30b-4fe9-9c71-cbd978215a68", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377871, "uuid": "e5600676-580c-4892-b745-d93d8416bc19", "value": "question 05.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db7db73-af2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1620389548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389548, "uuid": "1d25cea3-7b53-4615-b187-9032ae088101", "comment": "Malware payload (RaccoonStealer)", "value": "705e3e540053591142af5a8f4bac8c09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389548, "uuid": "9e18bc8f-0371-48cf-8b91-526da91affd7", "comment": "Malware payload (RaccoonStealer)", "value": "75c3a83073d9b15d4f47308b5d688f1ec07422419e3bd54e78f6ef8683d42e5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389548, "uuid": "24982028-b749-4f11-9ee2-9d797d4c8712", "comment": "Malware payload (RaccoonStealer)", "value": "3cfaf4f2bc92c52bafd9ff46d9950b8128dd9006", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389548, "uuid": "abf2ce6f-0427-4062-8671-e7e368e9e559", "comment": "Malware payload (RaccoonStealer)", "value": "c4ac91b4a016b18af55b2d9ae415428ff3287d50a979d5e69f3f2a17003924b0a18b36ff2c63624f7b9fdf0129b41477", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389548, "uuid": "fbafde3d-b0a1-4cd4-8935-353167026759", "value": "0615F121BBA0C432E6B712F549BB867DA0287DA1572460CB53E46BEE46347E4BC31F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389548, "uuid": "02942d0b-8c21-4437-ad3a-04d261a00e57", "value": "fafec3728fea7e7bd44424f344c75130", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389548, "uuid": "7b1d90db-6a44-46e8-ad91-c8f8771849f6", "value": "24576:TnbQ/EEUzoxpV5tJXzMuHZ0FQ5NmPyY52hT:TWEfzUpV5nDMuq1PuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620389548, "uuid": "1c71ff76-a7ab-461b-b914-846a0dc877cc", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620389548, "uuid": "fb46a45c-cf29-406d-ab23-2215a880edb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389548, "uuid": "ffb56ce2-1576-47be-b1b2-722c6ca6f457", "value": "705e3e540053591142af5a8f4bac8c09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8415b0e1-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1620392135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392135, "uuid": "0d7f7973-cf98-4200-824e-d00a3ebb184e", "comment": "Malware payload (CoinMiner.XMRig)", "value": "1fc1c860e86a8fbc2021d2567d62f703", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392135, "uuid": "e8433c48-acf0-4471-a0f1-0a3736349c08", "comment": "Malware payload (CoinMiner.XMRig)", "value": "76005ce2b7eb0c95f8dcc06b501244c73b17b3aff65e78c672c4a6ae56e67306", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392135, "uuid": "7bcae688-ad37-4597-94af-001fa5d830ec", "comment": "Malware payload (CoinMiner.XMRig)", "value": "42ea2c9f4548614574dff36e019ae1cbc68b54e3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392135, "uuid": "8eff110e-45ed-48b9-a34f-60d9f2b33268", "comment": "Malware payload (CoinMiner.XMRig)", "value": "e93642a41f92deda603ff8a91b01ea08d2211424854337a20fb6e2dbdbabc011e72184f9f9e3763a87c3a9dfa789699f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392135, "uuid": "7f2e169b-8f82-46b7-8445-c64857e1453f", "value": "D66533A9A05BD4ADD4D21D395B5CFEC10C863B234FA2391B3E48C1D02A356E163E9F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392135, "uuid": "22c861d1-903c-4cf5-b629-2d4685fbc209", "value": "f27641a9746cdd4a03a233e1cf5e6ee7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392135, "uuid": "f7fb96db-67a7-48d9-b4be-a0649fe3f0ea", "value": "24576:A5qezbM2Lh4oA3CMGGjXFQN/UTujRUsB57MSvpMnMW3+C/+QGJlsnUtZIi9u:Ak4ttS5vjXS3hZMipMnMW3+CaJynpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392135, "uuid": "51799f2b-ad13-4385-bca8-58a80a5276b9", "value": 1459712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392135, "uuid": "5b640c1d-11f7-457a-ab77-9f2fd3abcb5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392135, "uuid": "0f88d4da-8ae0-4e0d-bc8d-6ece432cd211", "value": "11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf54a91-aef9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620367322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367322, "uuid": "f9e5428c-f4b3-479e-bcee-b5ed7a2233ec", "comment": "Malware payload (Dridex)", "value": "18d62e11fe542d636cea8785babc82b2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367322, "uuid": "ffb11db3-0013-4519-8354-51a3d14208be", "comment": "Malware payload (Dridex)", "value": "762c14bed441de35ab755afa3eeff19d43e2f325242b6f909055c2dcf154dba5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367322, "uuid": "713d8419-b8eb-4842-8776-ec344edd1770", "comment": "Malware payload (Dridex)", "value": "795bfb6c311acf840fc16e49eb91343bcf10a1a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367322, "uuid": "5e3b040f-467e-4e0d-b91a-5d60c94339b4", "comment": "Malware payload (Dridex)", "value": "c7719ee0b59473d9d44cbc9cef93a0d3fa208794f66835664d25060c9bea52158b74ca6c4aff59b5da8d5b23b9542f22", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367322, "uuid": "620af138-56cb-4dbe-b228-13eca4f1df7d", "value": "BCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367322, "uuid": "9a1571ef-3236-4b3e-8279-4b65b512f244", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367322, "uuid": "2d2bb5fd-3452-4e43-ae3d-b59b2f70770e", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620367322, "uuid": "d21619f2-2f31-4a04-ae44-4eeef0d57a8c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620367322, "uuid": "9224532a-1b7b-4fe8-98d1-aa975be75f46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367322, "uuid": "94936466-2188-4348-90fc-30695f11d9a7", "value": "18d62e11_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2d8701-aee9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620360205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360205, "uuid": "103bd0b1-704c-433e-a909-63706bd9ae99", "comment": "Malware payload (Formbook)", "value": "52289e533348a695d881c6df2d895f5e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360205, "uuid": "cab3c20e-2d84-49d0-bcce-6fa72391992b", "comment": "Malware payload (Formbook)", "value": "7653e46e3326fbabf9e534cbd02600f87ad38b5c9e4e175a60e27a6d90c5e6fe", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360205, "uuid": "77fea1be-ba2d-4fe3-97e9-35d2952810ae", "comment": "Malware payload (Formbook)", "value": "2cc712357a0d94f590eb126f2697373d9cca4ea1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360205, "uuid": "6871d2b2-6a33-40f2-b8ee-8ba2ec89eb45", "comment": "Malware payload (Formbook)", "value": "d20aff91c5b1bc5d9f2af413f7327885701bd6f37b3c736b9d6e92b8430ab362e27bc2f16c6802d3adbbfbc70e2f2527", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360205, "uuid": "5db33cc6-b48a-409c-9235-4cf79178e8a6", "value": "E91528EC751075EEC657CC23DBCE1C15A6202176972B9607932303BD9A0EE57AF388DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360205, "uuid": "7d85be27-8321-4330-85cc-c0719b03ba90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360205, "uuid": "fe6fd3f4-a551-4ba7-999c-4a73efb10f38", "value": "12288:WK1Fd0hQ4oLLoS60/K7yh0rvVtgD13nBXxsXKNFORxV57rVlmQyTQ0dnHUR+vtb8:BnahQ4oLArv3gD5npxsXvVNrVlm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620360205, "uuid": "2869332f-7ad4-44aa-b6c5-bb6e900f8ca7", "value": 935424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620360205, "uuid": "07e7d18a-0171-4fb8-988e-c8981d7913ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360205, "uuid": "47b97939-989a-4f6e-84d4-4e12c131d6b5", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.9130.4062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579be9bf-af77-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620421267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421267, "uuid": "de8c6f3d-79c4-4d33-a874-1fc63b778990", "comment": "Malware payload (Dridex)", "value": "783328019ca2b1a0f58206ed5635fb57", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421267, "uuid": "ee66166b-9b7d-468b-9718-ec8bf44ff3ea", "comment": "Malware payload (Dridex)", "value": "76ff9066396654650fd24e72023d25dae8dca74a601fe7a348d8afadc0bad129", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421267, "uuid": "12364bed-fd0f-45ce-8b2d-258c39511f09", "comment": "Malware payload (Dridex)", "value": "04e3adc8cfce5bfc733e903a9712b50d703f9610", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421267, "uuid": "c9311b0d-415a-4e77-88e3-319926f8438a", "comment": "Malware payload (Dridex)", "value": "1b45c957689ec3f85de3cc5196e08454e109a739a79054e98d4f07e95e1c9f99b701372fd4d99d27cae338a2346fd02f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421267, "uuid": "57d8bd5b-3118-4c22-94c8-23052ef0c7cf", "value": "B3F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421267, "uuid": "4ea66ead-3620-41d1-a0b0-9cb68290e7e4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421267, "uuid": "1e5f392b-f590-4cf9-8123-ea01259d7317", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620421267, "uuid": "d599d1a3-6291-4851-ad85-21d125bfcc9a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620421267, "uuid": "d29be999-472c-4fee-8cb9-e2273fa22c54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421267, "uuid": "2360a223-b12f-411a-9722-7448e6639485", "value": "78332801_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1470345a-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407410, "uuid": "e67fc6d7-7e14-488f-bc48-e80397d6c959", "comment": "Malware payload (Dridex)", "value": "87ecf20791c765d6037260c88ac1c7ea", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407410, "uuid": "3e6b0702-c339-45a2-8d3c-b2d0ed834cbc", "comment": "Malware payload (Dridex)", "value": "770686351484980c7daab61f951dada02fdd3d7734b01643ed2763bdd1a3d53b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407410, "uuid": "9443021b-fd17-4034-89e7-b12172312531", "comment": "Malware payload (Dridex)", "value": "382b64a0836be6d36bb57c8f80a7612c500b16e6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407410, "uuid": "d85d42d4-ca5b-4bc4-8c90-c838fbe9c875", "comment": "Malware payload (Dridex)", "value": "9d56fde3b4f58199ba538b778a835b8e6435900bf00e361c758a6a171f952e140d0bae2e54751cefe94265ddc62ce0e1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407410, "uuid": "344bf697-3f94-4aa7-80a5-a0eb4757d9cb", "value": "DCF3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407410, "uuid": "987fe2ad-e1c9-4867-b5d8-6a96545a256d", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407410, "uuid": "3430e0f3-6e6a-40fa-83ca-21f131f85240", "value": "3072:BBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHSa:fuXLcclWEc2HeSjNjGdeya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407410, "uuid": "7e811851-0b9d-4fcb-8f1d-a5f540ff024a", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407410, "uuid": "e72e9746-e1eb-4667-804d-ec9f6a05b47f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407410, "uuid": "01471258-50a7-4b8e-86dc-9366492a2ef2", "value": "87ecf207_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba431662-aeee-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1620362591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362591, "uuid": "50d2f7ef-3965-4268-b636-9be2729e2dc5", "comment": "Malware payload (QuakBot)", "value": "336aaae4fa380c66834c8665172cf179", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362591, "uuid": "967e2bc9-6e07-4360-aac8-a7e9bb7f7db8", "comment": "Malware payload (QuakBot)", "value": "7803a0cfd5572aa9d9e3d60b071a26497823bff93f4f656f9d7fcfea561a097f", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362591, "uuid": "4d1abd8f-897c-47c1-95d9-e5ec6f1ea176", "comment": "Malware payload (QuakBot)", "value": "c0a93f789ce3bb1471cce677573f05143192cc90", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362591, "uuid": "50a1caf4-28ac-4e7f-8f11-48c40b2cc9c0", "comment": "Malware payload (QuakBot)", "value": "16018e0bde67f8cbbf7e5d3f3fad94abadf9e1384cebc720f281d4368d9701d9553fef20455339d24e808037e1c7c0b2", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362591, "uuid": "4599eab9-2d0f-4738-9302-d2fa5da34757", "value": "4D44018FE4488E82CCF2367BFA19D3920D4A6936526391DF447DC9648BEFB71572108E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362591, "uuid": "20d4a8cc-63d4-496c-9ad5-1150357e86ee", "value": "ee5fdfc0db72ef940bfed3428eabdafb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362591, "uuid": "d1f8c359-5326-461b-aa1e-1aa3d34ad99b", "value": "6144:NXfc7Dv1eK98DlbZ0LiHlymkJofZclWsr7RYWxi/1:Nk7DNeK9y8LiFyVlWsrdZxid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620362591, "uuid": "bd62b7ba-006a-4a61-8e0d-bf57fd14cc12", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620362591, "uuid": "b2a3bafb-2379-4ff6-b05d-318cbe2507c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362591, "uuid": "4b2177ab-c598-4863-a3f1-946ee86948e6", "value": "19.gif.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6fcb14-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620414052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414052, "uuid": "8ea73d5b-f73c-4a5c-9b62-e6c7e39b0732", "comment": "Malware payload (Dridex)", "value": "f58c092d690db16fb709c01cb1ac06a0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414052, "uuid": "75d0893c-c951-4677-b5f3-a3ea6f1548cf", "comment": "Malware payload (Dridex)", "value": "78304d1e9e006e4d9708b4c5f15fbb73da8e0939bd00b97be7684c8b436d8f1a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414052, "uuid": "310f400d-7232-4d8a-9171-0c7b579c58e0", "comment": "Malware payload (Dridex)", "value": "dfdd8095e21878353a4abeff9efa5b30adad7d25", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414052, "uuid": "bf4abcd3-0fc8-46b6-82f6-6dc96fc2330f", "comment": "Malware payload (Dridex)", "value": "14c168474728cf851802ebd317d06adc0be9012440d0c3d161dc2b063e67909bfbe5e122fdf87b1ed933948fe0074c1d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414052, "uuid": "4c52e667-cfd3-4b62-868b-64193dec485a", "value": "36F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414052, "uuid": "14424ee7-654f-4de7-beb2-a0f1f74df9f3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414052, "uuid": "5c31d8f6-0f8b-494e-af6c-c7d8c5a25ec7", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414052, "uuid": "1e8baf55-98a4-41f2-8ab6-73da8bf210c7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414052, "uuid": "29068128-b36a-4e81-8e0c-38b557b28834", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414052, "uuid": "938c457a-eb14-4a33-a5b7-b850f5ba1069", "value": "f58c092d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706a8a1a-aee0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620356454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356454, "uuid": "155d26ec-b679-4378-8d7e-b2e43e837d30", "comment": "Malware payload", "value": "12218d47ca7cc4201ff1d17b214e5daa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356454, "uuid": "5e7732f3-5cd5-4e2b-8e50-ff2e6f316f08", "comment": "Malware payload", "value": "7831e7e88558217f0704fa656fd6ce568c3529159099c31426adee195295c17a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356454, "uuid": "ab4d6125-9e45-48ec-9ba5-ea6c0aac5b7e", "comment": "Malware payload", "value": "e362987c2493d21d4834f79c48f60591f45a808c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356454, "uuid": "f850bbb8-6e71-4cc7-9e3b-456863a862aa", "comment": "Malware payload", "value": "81e2e60101d1a070fb371a2554534cca771a9568750f8217ad1953b56e07b57de382fbfca10036da708d9e4edfc7cbab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356454, "uuid": "ca12fd11-a75e-44b5-8d34-8fbacc71d241", "value": "E3D5336E41FAA7BAD8672DB5E1096E5F23E343B02D93D94D77B529BCE70340286C0871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356454, "uuid": "5ba0b677-4ceb-4d11-999e-a1d6addd9533", "value": "49152:yPu1/xTzvu0Ge5Qn6rDarAO6Frec9a304Umt3NyncX19ED2anNP7f48pjx3fXx1:yP+xW0G+4cFKM4rNycX19EyaJ48pv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620356454, "uuid": "d3a4e657-789c-4fcf-b910-766282f79efe", "value": 2981046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620356454, "uuid": "e12883fb-48c3-4182-8175-dc7934194255", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356454, "uuid": "eb68e931-81be-4ea3-82dd-94e3265b1dc7", "value": "12218d47_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87fd660-aecf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620349327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349327, "uuid": "fbac2222-c53e-43bd-94dc-39c8bdcc7847", "comment": "Malware payload (Dridex)", "value": "6672c5ab149803157484222387d207bf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349327, "uuid": "b83f887a-3f3e-4b45-ad10-887969395398", "comment": "Malware payload (Dridex)", "value": "7836653e8e1079edb356e6a7d09519a094e64a02b406e1402eae78bb66cf0def", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349327, "uuid": "b653a6cb-4f63-4d26-8a0f-365aa9a2504f", "comment": "Malware payload (Dridex)", "value": "0d45ad2cc9242a3d80ad2939f1758b700141e242", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349327, "uuid": "1b622a73-db32-414e-8e55-e54083777e0a", "comment": "Malware payload (Dridex)", "value": "05b8558824b2827197533f01043147e633da1ab07bc7e9313ee206dc6a13122dc38531633c86d71ea9d45770b4a50574", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349327, "uuid": "f19db40a-af35-4d9d-98b6-971528a07c40", "value": "60F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349327, "uuid": "27145410-65a2-4aee-9507-acda653f0069", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349327, "uuid": "0fca0e01-b2d3-404a-9d32-ee710a4aaff9", "value": "3072:+WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:+42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620349327, "uuid": "2c95d2db-ac74-46fe-aaa1-a1f653cf2b85", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620349327, "uuid": "8d14bddb-478c-4308-a8a4-cff90479d2fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349327, "uuid": "3481f2f0-1f18-45a8-b5b1-3b09ead2d752", "value": "6672c5ab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea20439-af39-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620394703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394703, "uuid": "a89f9f69-4b0c-4496-bd07-72ff1d57462c", "comment": "Malware payload (Mirai)", "value": "ded61e3f9e9e9ce545a44990cd156e71", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394703, "uuid": "47604b4d-f233-4bb6-ae91-1eff327a3b22", "comment": "Malware payload (Mirai)", "value": "783a98ae2c9b763237688a9a3cf2d951985ea9df5b02ebe752da74d273fc3712", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394703, "uuid": "64a99600-f834-4769-94ba-30ed20404282", "comment": "Malware payload (Mirai)", "value": "5fc49f576762502e1fe77044877bd687a1e4e7e4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394703, "uuid": "ffad314d-99b7-4556-8cdd-8d99d38e220a", "comment": "Malware payload (Mirai)", "value": "852ec418fc4b45fc9c2e564cbbbb6002ba735571052b2f5c95eb304bfc42d7eb635fb12740595b415786b76ea5025b31", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394703, "uuid": "07348ed6-86d8-40b8-b975-7103920da18d", "value": "92835C4272180A87F1560EF9293F17D0A3AFFD5062E6F288694FDA1A5131E73158BEDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394703, "uuid": "4abe22a3-d382-4140-839a-df2408ff2ab1", "value": "1536:nPukm+DLf9pOoSDhVvJD7AOZhUPkIIx6H:nPb7OPFwOZAkIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620394703, "uuid": "e4e2cc4d-934a-47b7-b8b1-6070125b7d81", "value": 83752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620394703, "uuid": "17e1849e-b13c-45ad-bbc8-bf0734de6b92", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394703, "uuid": "0cb6ff2a-afa8-4fa1-ad70-b0dba77cb07d", "value": "bo.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96585de5-aee0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620356518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356518, "uuid": "2b1e4f2e-3e72-483b-b744-9ec46256691c", "comment": "Malware payload (Dridex)", "value": "29c42404d7106e04e8758547b05001fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356518, "uuid": "6e385c8f-0735-44d7-bf7c-a88ae8b42763", "comment": "Malware payload (Dridex)", "value": "784ec94b447a73f54827dacfa9ee6d5e29497341e4910704f5bac53d22f281f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356518, "uuid": "7b5dc804-3321-400e-9c48-f84521d9d2ff", "comment": "Malware payload (Dridex)", "value": "b9386134d1b0c19ef4c904462d0c0f211311fab5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356518, "uuid": "5014b18b-37ec-41a4-b987-463da2557121", "comment": "Malware payload (Dridex)", "value": "cf77aae612ab4410e5416c5909655115e435c30af97d8d10c2edcc10b600db0cef573cb4d27c19b76b99488a53d1fb37", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356518, "uuid": "b69439f5-ff3f-42e1-8075-97ad681b75b9", "value": "AAF3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356518, "uuid": "437f55ef-b3d7-459e-9cdf-5b33bd615686", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356518, "uuid": "cdd24460-e93e-47cc-a613-3c88f93db60c", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620356518, "uuid": "0d642835-7fe8-4846-967c-6cdb1a636a98", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620356518, "uuid": "61fd27b1-8508-44aa-be2e-c98d9e7bab4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356518, "uuid": "c27e1fa5-0998-4a3c-b75e-9a4eb56ba256", "value": "29c42404_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ead6f9d-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403964, "uuid": "c484b3d6-84bb-493f-9721-06f054229eec", "comment": "Malware payload (Dridex)", "value": "4c6747448557ccfeaef30d9ddaea1bba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403964, "uuid": "1eb3701a-944e-4366-9ca5-a6947e3481b3", "comment": "Malware payload (Dridex)", "value": "785f87ea66c6a10d65d24d568ea18c33ee8b0ded94c0538f3fe79893df20c5fa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403964, "uuid": "41e77bc6-3a33-4dd1-a3ff-525627949e0d", "comment": "Malware payload (Dridex)", "value": "79c098c6b6e1162234955c75c11b5c2bbfd0c5e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403964, "uuid": "93e0fc6f-06f3-481d-a135-9443def936f0", "comment": "Malware payload (Dridex)", "value": "653db368fc0f230a3e617dcc995b7c18a688a199291de019be5c221e502af76b00420bb8aa5ddd3cd8493e82855e80db", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403964, "uuid": "15f42731-650c-426f-9c8b-bbf94688d425", "value": "B8F3D141C9C5CCE0CBF36C3A4795963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403964, "uuid": "5e2f7bb6-b738-4127-9f78-15d3cb5ed9bf", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403964, "uuid": "62eb537b-bc1d-4bf2-8a1b-32e1caf661e0", "value": "3072:OuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+zG:O0czbty9uiaJlyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403964, "uuid": "f6b97949-444c-449c-b152-18f86134683a", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403964, "uuid": "050967bd-a182-4c78-938a-4ead962b6565", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403964, "uuid": "d6345295-ba7b-4021-924b-f1285ec124cd", "value": "4c674744_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f84019-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403760, "uuid": "71a3fbfc-74f5-4cd2-a5af-112289bb2c10", "comment": "Malware payload (Dridex)", "value": "27d303b472222c9817952f5c774fb145", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403760, "uuid": "ece76769-ce23-45fd-b55c-419a81f64d94", "comment": "Malware payload (Dridex)", "value": "7869a7dee9d6614b6b54171e2151c31e7967d793971e72dbf3d2d4dbeaa28680", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403760, "uuid": "6ad8d2ee-ae14-4343-9b4d-87f59ab2ba88", "comment": "Malware payload (Dridex)", "value": "da66db65e5e7d93d4b0bd48b2822aedee7566418", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403760, "uuid": "58492eec-e8ea-41c6-96a2-0314cb8104e4", "comment": "Malware payload (Dridex)", "value": "426f2eca41c5b1718ee9fc68512e8d5e9dc7c00a35cc07406407da4aaca298e7dcbc4c057b06b81a5ee96019f00521fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403760, "uuid": "d3d69883-3a78-455b-ae2b-8708aa99e43d", "value": "6BF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403760, "uuid": "10242465-3c15-47d7-817a-df311d732df2", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403760, "uuid": "329f37a9-677e-40f0-9302-c82c6dbd0166", "value": "3072:Rlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Rlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403760, "uuid": "650522c4-f9c8-460c-af04-13bd6b0ec2b5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403760, "uuid": "1c88ac30-b092-44d4-b11a-db24bf06e407", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403760, "uuid": "ee421ea8-7ac0-4479-b492-74e0d71b501d", "value": "27d303b4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39c1fd0-aecf-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620349319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349319, "uuid": "3c7c14bf-df29-417b-971a-05783eefa922", "comment": "Malware payload (AgentTesla)", "value": "11710b5465a4e7020cd563074a8078a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349319, "uuid": "61a7ca0e-509d-4c8e-8aff-b004b44489e0", "comment": "Malware payload (AgentTesla)", "value": "7869ecfcf6a7380c9b011d0a7bdb334f0f4d16cba20e3c5533db88c558ff9220", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349319, "uuid": "39a0465f-9e31-4032-9e96-e598bb068f78", "comment": "Malware payload (AgentTesla)", "value": "53e3c395cef7d68cf2fcff45049457c813b61cd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349319, "uuid": "693fc172-4ef9-481e-873f-61bc50162a51", "comment": "Malware payload (AgentTesla)", "value": "81c6d0c1f9052d4ac74acec891904f33a6e1e5b84e05690adaf8b23c88e079a4e68d032fdf1a868be8de967ab41544e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349319, "uuid": "a020ba25-c59e-4e64-84c6-fb9a474d61f1", "value": "8F85E1548DFBC58EA1A89F0B5B55840D1EBB7EE81835A1D2365047EF0B27A0613C1FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349319, "uuid": "eb20eddc-853e-4a09-a0ee-2293b66861d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349319, "uuid": "dde3974b-0c0c-4287-b7f0-a345223d916e", "value": "384:JqUFaCfUs9moaL7Yvvm5cjX5sZUbouqOMsUVBDnVl+8p20Bu+hb+9RCwRJ+bkZdF:vuVeVGKAph+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620349319, "uuid": "abf61c03-b24c-4bd2-874e-fabd4c204786", "value": 1841232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620349319, "uuid": "4a9772bc-cc2a-470c-8ff8-16c457cabd8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349319, "uuid": "f1d9b428-e477-4e4f-8fdc-cb0fbeb79177", "value": "11710b54_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e522d46-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403695, "uuid": "9d0f8aa0-2a3f-4725-a3a0-bab9a71d7996", "comment": "Malware payload (Dridex)", "value": "cf176618094e832c319e07c4509bcf5d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403695, "uuid": "dcf15fea-e7e2-4cbd-aaf1-d520dcbe40a9", "comment": "Malware payload (Dridex)", "value": "78a54fee8463c7a72fb3f959f9607b99b949603a4d8f3d061611fcbfe4a94c22", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403695, "uuid": "78229e27-aaba-4e69-a658-22f57a3d69fe", "comment": "Malware payload (Dridex)", "value": "34257f03f514c74fb36eb4f090b382d3ac527a32", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403695, "uuid": "e2fd234d-2d6b-4c55-a759-09cca7507be2", "comment": "Malware payload (Dridex)", "value": "064df9fa432af302635862ea48ac9a0b0c5a1bc39f518487af702e6e2049b9004de635335aad4497083057ad85f23ffd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403695, "uuid": "244fa1ff-b82c-4cec-9e93-af8375fdc8fb", "value": "D2F3D141C9C5CCF0CBF36C3A4695963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403695, "uuid": "eabd39b1-1170-4bfe-9adc-bb6d379c89d1", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403695, "uuid": "970fb93b-57a3-4e2c-a35f-a807fa828c61", "value": "3072:UuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+3l:U0czbty9uiaJlCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403695, "uuid": "812a4c58-168b-441b-85c2-a12a8052361d", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403695, "uuid": "a33cc68a-ec6a-4dd3-8740-8c6066b3e187", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403695, "uuid": "0d855725-bfd6-4ebf-81f9-f619a84ebe9a", "value": "cf176618_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368b71bf-af1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620381697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381697, "uuid": "0cd1ff1d-a3ad-49be-aba7-44715afb6c31", "comment": "Malware payload (Dridex)", "value": "dc0dcd0d3e30f45479f208264b1edeac", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381697, "uuid": "104428a3-5057-4277-927d-36f8349c791c", "comment": "Malware payload (Dridex)", "value": "78b34972a0b248b36d70e906bf42458c4500db5f0eb81b64c93e1ba599ca6561", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381697, "uuid": "cfe3eee5-2cf2-4092-bf09-817bc395a292", "comment": "Malware payload (Dridex)", "value": "a770642461b1d544461ef0f4dc2c948747605851", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381697, "uuid": "abe5a695-9bbc-4f49-aa2f-336eac88849b", "comment": "Malware payload (Dridex)", "value": "2734a8e962713bce416d10eef3e3e594a1b6c2c9cca9cc4db54c4af8dbb8c644bc5bb069be710a7a620fea8a22ef0037", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381697, "uuid": "b153d60f-6f6c-449b-8e84-b15a69e4b06d", "value": "56F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381697, "uuid": "01a6f1e0-2e28-4750-9d2d-067adb573e62", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381697, "uuid": "fcbb5835-f9a4-4472-9940-e0b0ab8d56ff", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381697, "uuid": "e28ab094-7076-4e20-a007-e12723758398", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381697, "uuid": "66fe4723-449c-47ac-bb81-3d23471510ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381697, "uuid": "5f974dc6-eb3a-4e56-a004-1a2d149fb68c", "value": "dc0dcd0d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db326c01-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1620403878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403878, "uuid": "63ab4c74-7a81-4af5-9a15-d84b65785ae9", "comment": "Malware payload (AZORult)", "value": "b5090c112b6fc79a202ea0488279e184", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403878, "uuid": "4f8e2f52-1c1e-4541-843d-80adee21916c", "comment": "Malware payload (AZORult)", "value": "78c09ced1d0c809a20190231684d210cf48e0c03415026bdd9266a6c3d8a3c72", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403878, "uuid": "871c0a08-342a-461c-b42f-553744285000", "comment": "Malware payload (AZORult)", "value": "29cb202ec34c167fb61d35b95463f44d37c62c10", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403878, "uuid": "51fe7c7a-4cab-4c9a-95a1-6828c4740d78", "comment": "Malware payload (AZORult)", "value": "db05be819ce9878b0bd43c89ed299035201fc66cb7dc49345cb1f559f28832ac1850046c8a6859af0581fb911ef3b2de", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403878, "uuid": "68af5cf8-cafc-411b-8559-2c9c2abc559d", "value": "2A858FAE73C5A93DF542C17C501C9A19919CED7062A9D48DEF837BDB78F0902A339983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403878, "uuid": "7cbf11d5-c11d-4a9a-a6ec-d68431e0c1e7", "value": "73a093b7c76c99d3ebebcb9ee6730b09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403878, "uuid": "e7630573-aaf0-4479-a9f5-2b1c51c22311", "value": "49152:M+jO0EC06kPzkOn3W8zh2HXcpEK61nG5b5F:M+jO0EC0RzkO3W8tgK61nG5b/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403878, "uuid": "52db2339-2bac-4584-b602-bbcf1c48a6cc", "value": 1802802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403878, "uuid": "66eb6228-fb82-4f84-add4-4eff5e6a16b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403878, "uuid": "5b1403e7-2550-4d6a-8b90-204ce09db05a", "value": "P.Order #3434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206db92d-af3e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620396693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396693, "uuid": "97582e5c-71c5-4f6d-86e6-a03463fc4c5d", "comment": "Malware payload", "value": "d249dbdc4419806cb4cea80afa2a07b6", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396693, "uuid": "6a809f7d-9ec6-4c4b-9a68-f33abfdc64d5", "comment": "Malware payload", "value": "78c5f78281c2d0fa7282eef77f2f873714810a01f08908409d720c84e2aa89d0", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396693, "uuid": "cef69885-ff0b-4696-a951-b253dea44451", "comment": "Malware payload", "value": "9fa9c07f42656d7bda8179b31b864d7825b31045", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396693, "uuid": "0b928951-47dc-4b0a-9666-e6111437a72c", "comment": "Malware payload", "value": "91c57b702ed5c5513295b783951be111c4da7c6a8af3556f7fff996e810d66188f21689c2ad229c8f04475827e4b0757", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396693, "uuid": "35f9092d-d0a5-443d-9a3e-9dfd6b29c29e", "value": "2031E7C71C63346D6CE1AD222B6A470471CCBCAB448EFB4574D8EDDA42DCD147365E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396693, "uuid": "14ec0d1a-1322-4ad7-9cb6-e7fc9a046f3e", "value": "24:xUJU30G7JUV8tedLSUdzYxpTU7E6UZYUw+UZNIlkeXUjKk:xUJU357JUV8teIUkUw6UCUw+UgLXUjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620396693, "uuid": "233c84f2-1661-4007-920c-70fd8f2eb27e", "value": 1816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620396693, "uuid": "19998146-5dfd-4966-9f8f-258fce58acac", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396693, "uuid": "a598fd69-70ba-476c-862e-14771378e1cc", "value": "78c5f78281c2d0fa7282eef77f2f873714810a01f08908409d720c84e2aa89d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968aea87-af25-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620386153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386153, "uuid": "7570afc9-6460-4e04-bb45-c9f4cfc02737", "comment": "Malware payload (ArkeiStealer)", "value": "e2ad8356a0f8868549918da28a853eb8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386153, "uuid": "a73dbd56-efa2-4723-8a2a-39e89ca434f3", "comment": "Malware payload (ArkeiStealer)", "value": "78dfcb8de3fc0b3cc573370bd92f0efd88a151e06d8e32fb6db12ca6daa09a00", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386153, "uuid": "ff7a2804-6404-403b-a23a-54be859b0808", "comment": "Malware payload (ArkeiStealer)", "value": "a54d44cf9ebf627de89c3bd7b5ec5685f15538af", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386153, "uuid": "4cf5715c-923e-48c7-b084-541098d585dd", "comment": "Malware payload (ArkeiStealer)", "value": "c87ee53ee33100bf53c2ce4eb3a6aff265bcc04ba529b361e0d99c3d003a98acf74b1607237c9aab343f9b87d275b928", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386153, "uuid": "068ee940-2f63-4512-aaf9-f35ada57d00c", "value": "52A4BF66F6229C27C5650CFE8D23E69B03B50FE178A5C782F8C563E76616FDC8A52043", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386153, "uuid": "c1579dd1-3965-4f34-b9c8-fbfb0d10b5fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386153, "uuid": "98a70d35-ea40-43c2-9f57-f5f4eec5503e", "value": "6144:1FCfchsAw6584yvttH+v6d2JwlKaBuwVIR2LPm33w9uhBJ5:1gbmCttev6d2ylK9UIdnJXJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620386153, "uuid": "d7667b72-e5f8-411a-a904-57268e169453", "value": 468808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620386153, "uuid": "1c9eabf2-80b4-4860-8c42-e0564d9345e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386153, "uuid": "dff65c72-5cf9-49fa-99c4-39b1547e3003", "value": "e2ad8356a0f8868549918da28a853eb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a02366-af1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620381726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381726, "uuid": "1cbefab4-dcdd-4f75-9565-0ff6723ef199", "comment": "Malware payload (Dridex)", "value": "c279a3f157ebb3d155b30933c6441602", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381726, "uuid": "2af22194-a912-4550-b0e5-631ad20e797c", "comment": "Malware payload (Dridex)", "value": "79193531b6e3f267fa9dae76b62946509bfe4c0e0f459fd776acc1e37c041210", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381726, "uuid": "87bdcaa4-adec-4f75-bc83-fed9f06b691a", "comment": "Malware payload (Dridex)", "value": "a1db0417f66d0a874c50b42fde2facdb1bd8b68c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381726, "uuid": "a4b7039d-e4c5-454a-a4b1-845d0d21b124", "comment": "Malware payload (Dridex)", "value": "54361a460d01ac940ccf45d7ce73dfb064561b269a0f15fb3790fc552f5a86c98011af02a7134dfbd7d044ffcf26a0b5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381726, "uuid": "2abf823b-2855-4392-935a-43a67015f928", "value": "09F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381726, "uuid": "2fe98db1-e7c5-483e-8b4f-a3f8c55b1c1a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381726, "uuid": "19b7f508-4f52-45e4-a971-820e7ff134cc", "value": "3072:ulpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ulo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381726, "uuid": "5b943790-ebd3-4cf2-83f3-b901fd471f22", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381726, "uuid": "8839167b-ccdc-4de5-87e1-1aaa46cd3fac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381726, "uuid": "ea9aaa18-7f45-4f89-a231-6519baab256e", "value": "c279a3f1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055ab967-af06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620372595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620372595, "uuid": "f01e1471-d25b-436d-9055-2cc9dc6efa17", "comment": "Malware payload", "value": "a88e93c8b1f4cf84bff50aace1293810", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620372595, "uuid": "361ea306-5210-4f83-8fce-f6bf4414bcad", "comment": "Malware payload", "value": "792dfd591d74cfe331e0db76a181b02a3aa08c43bfad4512251a8214ba3dd1be", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620372595, "uuid": "f3a5dcc5-5f53-4616-861b-298888a4c1bb", "comment": "Malware payload", "value": "2a2b9dbcf0287e6904e438b7e79ed1c1956e5a7a", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620372595, "uuid": "aeebdea8-a100-47ec-91bc-bfcad00ec4c4", "comment": "Malware payload", "value": "64d09e56aa76c12775c63e6dc757ce70068eb2955069631b785060ac1d96506e556cd3ecdcb2e254c6b5d6f20fdbe93e", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620372595, "uuid": "198517bf-fc0c-4ae0-b402-3e4425fb361a", "value": "AC55331DF8054BC3E6AE8AB1854FC5A04868BCD417224B16B90F7F91BA75EF143A371E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620372595, "uuid": "3baafb6f-b845-43df-b51f-e452cff51dfc", "value": "24576:1b9KXBQ81tcjBI68iZWWU5lIg80BZwpU5QYoB8dD5EA0x4igI4P:tMXBNcjm6Kbr2ILQYRkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620372595, "uuid": "a7932bbf-fcdd-409f-8c28-1d52379f51e2", "value": 1406464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620372595, "uuid": "5a5ee2a7-df21-4d10-ad91-743f87d79ad6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620372595, "uuid": "1b1f9b7a-33b4-487f-9606-ec3609d5f4da", "value": "Product specification.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab8bb9f-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407394, "uuid": "9aa2716d-97ac-4678-9c3c-b614fae2eb2a", "comment": "Malware payload (Dridex)", "value": "242360ce5ebcbd94776e3fcab0165d72", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407394, "uuid": "8b5b867a-ea9a-4563-a09c-3af7853a7487", "comment": "Malware payload (Dridex)", "value": "792fbebe69ba3455c78978dc601ad438a503aeef31cdf15e57d838cb2ccaf056", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407394, "uuid": "198e16fa-01bd-4379-83a2-53764cacbf35", "comment": "Malware payload (Dridex)", "value": "134451ec48d836796d46513021a937cd5fd54b60", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407394, "uuid": "374808ba-932e-48ca-9dc9-cf07d47ae5ea", "comment": "Malware payload (Dridex)", "value": "b77a55c21d7788241c1954b0eee6c1f5fb7ccc33aeddfae44aeae27ab264cd76044a884f328b95a3d3d4b1ae7296b9f6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407394, "uuid": "7c517540-af69-4010-b659-bed1181362ef", "value": "0AF3D081E78ED5E0FC075B333E680EEF52310087691854E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407394, "uuid": "37c6ef88-66af-4166-a3fb-cad896b5f486", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407394, "uuid": "bb237445-6d14-48b1-9067-790119a4d313", "value": "3072:8BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHdC:IuXLcclWEc2HeSjNjGde9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407394, "uuid": "82ffc71d-e971-4415-a4eb-690df1012883", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407394, "uuid": "4e53a338-5647-4132-9d94-b00f0d503f02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407394, "uuid": "2670af62-5336-4dc0-ad97-556f2d1ccd7d", "value": "242360ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d1421b-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404144, "uuid": "5a7fc10e-c214-4d3e-a3be-13a0b2a70ff9", "comment": "Malware payload (Dridex)", "value": "22da9258a84ebb3a8aff43eec2fe00be", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404144, "uuid": "39bd7435-40a3-4420-b0a5-687dde9b19d5", "comment": "Malware payload (Dridex)", "value": "79583d734df10a1def9f64ce643391f53d4cd5317860aebb2276294666dd270f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404144, "uuid": "d68cc0b2-25a9-4f7a-8c6a-0a08aab20c9f", "comment": "Malware payload (Dridex)", "value": "04c05bd87ee440b0e252f33594f454d3adc142b9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404144, "uuid": "c42a33e2-aed8-4396-8ded-b3e3f046d580", "comment": "Malware payload (Dridex)", "value": "7223ecc05922ef90ec3649f074deb14164f70c0a208662b60e396d51c99a2af5aab1e58ced9fd87c141bb35fa3dc1696", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404144, "uuid": "c3a69013-a2f2-4eaa-a817-b57860046fff", "value": "23F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404144, "uuid": "f2be70be-dd2a-4a83-b8b3-f5b180c715ef", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404144, "uuid": "d31c410d-9ccd-4802-93ce-b4e971c19ae9", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404144, "uuid": "3f353b15-2588-4b87-bb28-00220cb32229", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404144, "uuid": "3e867603-ef5b-421c-9e94-e3457bcb48b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404144, "uuid": "54be2273-e920-4e21-b251-54a8a998db8c", "value": "22da9258_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039921e1-af1a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620381182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381182, "uuid": "4ebc5303-6222-4e29-9b96-8dfa21b0725f", "comment": "Malware payload (AgentTesla)", "value": "ad44d5764bd7ad4db1e725b66f01498e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381182, "uuid": "aac20942-f0bf-4954-b530-89888fb5e406", "comment": "Malware payload (AgentTesla)", "value": "798cecbce0139e502fd6b23a7d147480d25a168d93131ba2e59f5b81ddbebb28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381182, "uuid": "6994cc88-51f0-46f1-af74-7633db7be2f7", "comment": "Malware payload (AgentTesla)", "value": "2d64033647906613abfbe2da8176b768d88b9fd5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381182, "uuid": "9466f155-0c10-47fc-a959-a4d580610416", "comment": "Malware payload (AgentTesla)", "value": "8f63e7d647a79505e90c8057371498ada70d70f4519dd2921a3252c85424b579964d35b7737fcc5d400e02030cc23bc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381182, "uuid": "4d547ce3-a9a1-40eb-ad20-13b47ce175a2", "value": "CCF47D0427E85B97C2AE03B9E198E63573F5DE05A25AAB4B680BF9F53F7339045009D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381182, "uuid": "c7ee8be5-bc83-4df4-96fa-cb44c4887552", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381182, "uuid": "ad2f2b65-7b62-402e-9cc5-cdab4f9ecc74", "value": "12288:L1fxhwL8mLAHefRIZtbVqrTwqEZCK/hYwkEP/1E/hwceg:ZZyJAH/ZtxqEZ5ZVJwFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381182, "uuid": "4e571649-a9d9-46b7-96b7-a37f4b429f23", "value": 740664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381182, "uuid": "7da6cbf0-1402-4f4c-b4c1-bc2a11341701", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381182, "uuid": "55edf6a4-5e24-4843-b259-6235caf30205", "value": "SecuriteInfo.com.Variant.Bulz.463152.17172.32601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00a9aae-af37-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620394035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394035, "uuid": "a8826ecb-44af-4b87-b3c6-f08347bc79db", "comment": "Malware payload (Mirai)", "value": "a1bd1fbb2832583c0b592bb54d507dd4", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394035, "uuid": "b7c2dd97-c000-48e4-bedb-9a7aaac041b5", "comment": "Malware payload (Mirai)", "value": "79a701bb312685248adee56b8ac0b8ac268c3b94834699b0af73fa6b11152782", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394035, "uuid": "5dd556d5-4613-465f-a307-b3a17e511dc6", "comment": "Malware payload (Mirai)", "value": "2defd5bc8cd4e5c957654b68461acc7cd6b740b0", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394035, "uuid": "ad550025-a2fa-44eb-bc83-d313766937db", "comment": "Malware payload (Mirai)", "value": "1af6d6b394995da515cb56b75fec340938f1a112b4e8d3dbab05279061689b5665b0c3cad8c7672d8777c6f6ffddd341", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394035, "uuid": "4d1cc3bd-e3e5-4e81-b506-ce300b7d60db", "value": "0AC2E05822DF1F53E86AE1F7E5DD04FF276112A692BD63821DD884C25EE306C513C1E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394035, "uuid": "e30ec6df-a3a8-493d-82c5-9e32995bd5be", "value": "384:MouOszfC9KcYt59Q5byNHyBSv3GDWm/1/veJWOFASq7j8IrrFRYVhB01Kxqk:vuR0gvoGHy8vJmtzO8b5RYtEKxqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620394035, "uuid": "c27047e4-4b3d-4682-b3a9-18902bde3f1b", "value": 27664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620394035, "uuid": "b02e3dda-770f-465a-869f-0dcb6a1203a8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394035, "uuid": "69d18dd0-589f-42e7-8f69-a7ba21ac56f2", "value": "blxntz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec4ccda-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404126, "uuid": "3a9089b7-5887-4d03-a567-31386d5c6eb8", "comment": "Malware payload (Dridex)", "value": "f0d2ef6e9dcf2f4f766c62dab70c0ede", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404126, "uuid": "6ad3b81d-78fa-4251-981e-d1d651df2f6e", "comment": "Malware payload (Dridex)", "value": "79fbcf3003f6598b994a843fc685c25f517726cbc8be3abb5ac384242f0609bf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404126, "uuid": "df7b53eb-ff40-4355-9592-20e5e4845aff", "comment": "Malware payload (Dridex)", "value": "e5df6b53bc72469ba7d4e7c41b4e9cc8e5ff6b36", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404126, "uuid": "5966e2e1-ca6b-45d8-8e14-9af8f1e142a6", "comment": "Malware payload (Dridex)", "value": "fc74ee5b82160eab634c7b922898feb0031f8c930c7695d64cc1769f0a1385157119d1ceadf0cf2e644c70b912522881", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404126, "uuid": "5fceaf07-b8a9-4ae9-83a5-c31588778020", "value": "66F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404126, "uuid": "85f92949-9fe7-49fd-a13a-f079aad5ae07", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404126, "uuid": "6b5421bb-5089-4ed8-b297-a2f3ab3dd214", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404126, "uuid": "e00590cd-b5b2-4c09-a4c6-fdbae0f6b294", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404126, "uuid": "f8ebb969-63da-4d5d-bea0-4944bfaaf970", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404126, "uuid": "46f0cb53-e917-4e0d-bec7-fbc92e58f69f", "value": "f0d2ef6e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52c016b-af7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620424886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424886, "uuid": "c78215c9-aa8e-403c-993a-c6f135a6ad0b", "comment": "Malware payload (Dridex)", "value": "e8e4303324dda5b969ef729d514fe104", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424886, "uuid": "d912a919-58bc-48ed-a8c1-4d43b7c94976", "comment": "Malware payload (Dridex)", "value": "7a370404f029be559b4a8b91da39004561b29e891b2b0218e7daff60cf427ef1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424886, "uuid": "8619c157-75cc-4573-977c-62dfefeeb1d6", "comment": "Malware payload (Dridex)", "value": "5d73f332eabe6a19f1b959fa6f07e2a902763da1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424886, "uuid": "fb136428-192d-422d-8b6e-9e87f34a918e", "comment": "Malware payload (Dridex)", "value": "1ec14c9afff176ee918758b79baaf56efb5b696cfac9556ef1264d5986ed56a03dfbda6157f490f02207583266eaa8de", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424886, "uuid": "0b87b234-f29c-4039-afff-c753f86a1b1c", "value": "9DF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424886, "uuid": "e3ec3c7c-0761-44d6-98d3-8fce1cc612a6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424886, "uuid": "74524a33-35c8-402d-a8ab-63766d39e59e", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620424886, "uuid": "9e3b98b8-03ba-47eb-891d-763cc41f78b9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620424886, "uuid": "f541e7d5-2aa2-42b7-b34d-52d7dadc51d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424886, "uuid": "36826af7-ed9d-45fc-a61a-646b7f86be06", "value": "e8e43033_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab95fb36-af2e-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620390054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620390054, "uuid": "0af108df-f697-46ce-bd02-845f64fa62a5", "comment": "Malware payload (ArkeiStealer)", "value": "f2d2b846d5e7dcb78b8fb8c2b514fdf5", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620390054, "uuid": "ce9c77d6-d0de-4e20-9c2d-5bd67b752c41", "comment": "Malware payload (ArkeiStealer)", "value": "7ab3f26484a6668bdd10719916266d661d8ab4a9ae3f68b708b8154a593b110a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620390054, "uuid": "fd7ad886-c71e-41ba-bd96-f5c46703973e", "comment": "Malware payload (ArkeiStealer)", "value": "be5d9d877c495eae40b30917380111691f636e5a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620390054, "uuid": "e987b65c-cd51-485e-8084-c067452425d9", "comment": "Malware payload (ArkeiStealer)", "value": "229d00f70058f2a7986bd7363440c76d744f79a476f14102762cdec8f5cc382d8610387762ed7becbe79ba362c5256c8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620390054, "uuid": "cb670fd4-c3e5-4974-aaea-8032679f851b", "value": "8FE4E0307AD0DC34E8F716F849BA92FD792C7AA19B2450CB52D426EE56346E4BC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620390054, "uuid": "9738d3a7-6786-45d5-a35f-cd2b60b3a90f", "value": "c5944944647f897dc99e9f24f2d785cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620390054, "uuid": "745b4654-5e91-48e2-8639-5d6e9f2b6e0f", "value": "12288:MzIIyti/NUvGgJQ05IG0cPCBa1SJG/CryKPpxHFmI0HWtV4nkK:wX/+c0yv/anMyKhhgPWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620390054, "uuid": "b325e730-c7ae-47fc-a388-5512e9ba7d7f", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620390054, "uuid": "c8035352-ae91-45bb-a05e-bae9520192a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620390054, "uuid": "076acea6-9eb0-47f9-b38f-31da3c868677", "value": "f2d2b846d5e7dcb78b8fb8c2b514fdf5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d810f4-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407082, "uuid": "1d0ce637-72e2-4d93-b031-2cee5f3fc8e6", "comment": "Malware payload (Dridex)", "value": "10e4c647a64aa128bd32e3db89074c3e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407082, "uuid": "cd296d88-1ef5-4e90-a8ca-154f6a5ebefb", "comment": "Malware payload (Dridex)", "value": "7ae6a11f261899823ce0c784d137941be781af4f594f7df40090575c7f8e618d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407082, "uuid": "d8db3621-7077-436c-90f1-3187a6492c40", "comment": "Malware payload (Dridex)", "value": "d36c2f9424ef10d5f7e0237af1edb8554acc27cf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407082, "uuid": "9fa48929-36c6-4bc8-ac2d-8085c0858f10", "comment": "Malware payload (Dridex)", "value": "004aeab9898207c085c6ae4c9f6b62a8e7fbeb5719254a6f8f0d75d0a15a0e8569d555498606ffdcf50499b236a75e81", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407082, "uuid": "b97d2645-11cc-4840-914e-4763283a691e", "value": "03F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407082, "uuid": "438cd960-7df7-45c3-8292-8a9517a0c187", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407082, "uuid": "741da595-8320-407f-ae58-a7cb1a02abc2", "value": "3072:UBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:QuXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407082, "uuid": "40a4e198-22c3-475c-b0bb-0e37d7966cb8", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407082, "uuid": "c3fdd1db-5d0b-4af4-b498-973575379822", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407082, "uuid": "879c2433-c9d1-456d-9ad8-5dd4fe4663ab", "value": "10e4c647_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4754e11e-aed8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620352949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352949, "uuid": "5fc8cf4c-62bc-4c49-8385-2df351cec8cb", "comment": "Malware payload (Dridex)", "value": "e7753f02358466d864fdf68e3fc403eb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352949, "uuid": "2c83b728-6011-41c8-8530-fcd51cb5d194", "comment": "Malware payload (Dridex)", "value": "7af703b8ebcef30ec8ded68107c858696be8784984baecacf80bdca41bb9ddf8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352949, "uuid": "6dd7f2b0-aac0-4107-9d57-d202c474cde1", "comment": "Malware payload (Dridex)", "value": "cb557c87d47bdc0e33c7996b73430634bb16e0c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352949, "uuid": "ec824bc2-2b87-4deb-a7bd-7dc211b9a095", "comment": "Malware payload (Dridex)", "value": "b8ba323e86d20cb66c91c4ce8b0d33645ca52583ba2df3554010a5d1e17e74c69e11cda212015b8a5806c3b2dea497cf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352949, "uuid": "58ad98e8-7d77-48c9-b5e0-6c19b4a86502", "value": "40F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352949, "uuid": "31e9a1d6-f29d-499d-952f-c02451b899e2", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352949, "uuid": "251de752-a445-424d-bd01-23d3ed6b4f50", "value": "3072:Plpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Plo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620352949, "uuid": "22b356c0-6afe-46ea-81f5-756546601e08", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620352949, "uuid": "343c7a62-a86b-4471-a6a0-4bd4dac91da2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352949, "uuid": "ae0dcbd1-9df7-40ce-915f-ec189f0f1f2c", "value": "e7753f02_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc18048-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392236, "uuid": "81c8cd48-4256-42d5-8420-ce213f5f0a0c", "comment": "Malware payload", "value": "6944eb4e72203e3a56d2874ee3d8874d", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392236, "uuid": "86888155-2ff3-4c34-b54e-84dd94aa4f52", "comment": "Malware payload", "value": "7afc93942967cd33adaf42f4247d50b6db996eb79f452cf3f095fba5b8305035", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392236, "uuid": "fa083bea-435f-4251-873e-c03a3f1a5a6b", "comment": "Malware payload", "value": "f06d44f31d0cfd6372149748536161a3c09a7ce0", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392236, "uuid": "98886ae4-affc-4c9c-8e40-16fc9f4e74cd", "comment": "Malware payload", "value": "884dfd47778b43231f5e680ceaf34b0adfac7d5b7d4e4abe96383190d68f2b1c17dd1cfa66b1dbfd3177495951dd6b02", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392236, "uuid": "846e80d2-7516-4065-829f-d892a14de048", "value": "B5A1F750112C1AB17346697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392236, "uuid": "48bb55d6-652a-4c07-9433-62a2e60cf133", "value": "96:VRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:VRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392236, "uuid": "52a0ad45-6bcf-4734-8f4a-0f9af90a8316", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392236, "uuid": "dc30ea55-e798-47e5-8647-22499db22d58", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392236, "uuid": "9a173596-1251-41d9-81ca-a33069131d68", "value": "7afc93942967cd33adaf42f4247d50b6db996eb79f452cf3f095fba5b8305035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a2ec03-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620385271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385271, "uuid": "e3f1c66d-7008-47d1-a4ae-f97589eb0132", "comment": "Malware payload (Dridex)", "value": "cef4d16be649d0affbf404b8a434f2d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385271, "uuid": "8335ab2c-8bee-40d9-8ee4-0289ec4a1827", "comment": "Malware payload (Dridex)", "value": "7b0a95f58cc66a1bf3c997983a4fc87147e76b02d4897bc026c15e13898d8c7f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385271, "uuid": "656acbf7-2e4b-492c-adf4-da48ca1a70bf", "comment": "Malware payload (Dridex)", "value": "26c1fa9cc1d2e537465544d67abb2fb8c1002d1b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385271, "uuid": "083afa6d-1208-42a2-8e75-f22d7f1e85ad", "comment": "Malware payload (Dridex)", "value": "280dec1c9f2e44c7116529411eaa716251d32b4ec11237b79fe750ddf7e832b303878cba833888b588e4d173708e7399", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385271, "uuid": "76f053ca-2696-4dee-aac8-91f91a6b4579", "value": "44F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385271, "uuid": "72fe3bfa-d153-41f9-a77e-d7d79d60c145", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385271, "uuid": "cab8b770-52cb-4d76-8b26-b3b7f72a212e", "value": "3072:tiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:2eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385271, "uuid": "facfd3cf-05b3-4db4-a8ab-27d35a0e277c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385271, "uuid": "b4e64a9b-9078-4178-adf5-6aac674c916a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385271, "uuid": "70decef2-c4ec-4d03-a25f-8676256e97cc", "value": "cef4d16b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51c0d5b-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620414149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414149, "uuid": "d2d1edc4-f84b-4e6d-879f-99e142a55a76", "comment": "Malware payload (Dridex)", "value": "1094c991df8c7f7b22f2b335799a3dce", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414149, "uuid": "a355fbfb-0e1f-4443-99b3-b205f0c672f3", "comment": "Malware payload (Dridex)", "value": "7b343aef1a6b8fcd6cb0bc248fb03ab71d7278c0524367efd3a487450b46ed0d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414149, "uuid": "ad2434cd-9171-4885-b7ec-8237a3a09fa2", "comment": "Malware payload (Dridex)", "value": "4973d3b6f639d98fd9dfc96b0f1b8122cca0f04f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414149, "uuid": "4b2171e8-7f91-473f-8f62-038e17974134", "comment": "Malware payload (Dridex)", "value": "93421b97c8b24e406e19659628f647b9376601cc837308a491bfef10889856a16dc8a20e19d7d3e0086d979bdbf1d7a1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414149, "uuid": "c4d108cf-1fc0-4dca-938b-6c67081c7e01", "value": "63F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414149, "uuid": "5df436f3-9e10-44b6-b296-0e46a375ab63", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414149, "uuid": "64614787-00a5-4f36-b38c-b5a9382f5735", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414149, "uuid": "2c64033a-37ae-4aa0-ae69-66d0cf376e7d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414149, "uuid": "98d7c385-9405-41b2-a129-a8c2755d8c61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414149, "uuid": "97b483cc-12b1-4161-85b2-e47873b84768", "value": "1094c991_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6aa1d8-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620385277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385277, "uuid": "391cf147-6e79-44d5-96f5-44bd18ca20ed", "comment": "Malware payload (Dridex)", "value": "9d3457cecdb3075d6d2b8435678e98e5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385277, "uuid": "12cc21a4-8d57-4661-b060-07890b4bcc9f", "comment": "Malware payload (Dridex)", "value": "7b47f62aa33f23cc55d1cd7e93c80393cbc6ef61b8a6955da3f6c07288faddaf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385277, "uuid": "8b7626b1-bcfb-40ed-9f8b-7869dd045e0c", "comment": "Malware payload (Dridex)", "value": "93214e10487181d64c00cb8ca32c4267f9f7bc51", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385277, "uuid": "dc0629e0-2707-4d9b-be36-11c87f026b11", "comment": "Malware payload (Dridex)", "value": "2b6618e198c25c48d916402098e40b7adf7d397618f9e11771b05415646c694ffde4fa45891fa735717fd3b025177286", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385277, "uuid": "24ad0a9c-a613-44bb-bc92-6625e66a2d98", "value": "E3F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385277, "uuid": "c72d5dc7-3ca4-447f-853c-9b8cb1ec7bdc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385277, "uuid": "44767f3d-b5b5-4dba-b558-b7a63da39d5d", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385277, "uuid": "8b632671-9bfe-4215-9af1-66b9286ef5b8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385277, "uuid": "8d3b19c8-a4e4-4cbc-aaee-5861c9cd80b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385277, "uuid": "f01fe7bd-42c4-4a4c-9e6d-7f083276bf24", "value": "9d3457ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d896f6b1-af47-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620400867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400867, "uuid": "0d55e11d-9f30-4e6b-8558-96ae78954b12", "comment": "Malware payload (Dridex)", "value": "dfd7b3375007baa702f9b8a3fa0cf00e", "object_relation": "md5", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400867, "uuid": "3b6c9514-a75d-4f39-925a-b1b7c20b850d", "comment": "Malware payload (Dridex)", "value": "7ba635faa7d7eaeedfea10c6db6f86869fa01f3b8688acd59d1d0885ce68f57b", "object_relation": "sha256", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400867, "uuid": "0f7bceee-eac8-45be-8cde-0153386e1b4a", "comment": "Malware payload (Dridex)", "value": "e982fe1f9074ebd761784a0f3f0ab8f7a5173ace", "object_relation": "sha1", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400867, "uuid": "98a320f9-75a5-4292-bdd2-faa41ffb732b", "comment": "Malware payload (Dridex)", "value": "88d8951d59701e5bd0712f01d559711a498470e3cbc27ab7c6edec6cdabb0dfbc21e3b6e9a3d85da2c88281f871d3ab5", "object_relation": "sha3-384", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400867, "uuid": "53b260b6-6300-4815-8f52-61c9e48cc9b6", "value": "732412A9C5E1E91BCFA7283945C94F636597A051D2F3BC1CB619F23EFA48D0394914C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400867, "uuid": "0b87c4cf-f1e8-4c4e-b84a-3f6c82ecafa7", "value": "6144:BtuIO+/ENhLv5xyGBVeJZnC469axilrxDi:fun+crRBjeJZ369KYrxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620400867, "uuid": "79cd14da-48fd-4cd6-8cde-c4ffb55768cd", "value": 225669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620400867, "uuid": "b0ee3757-3332-44fb-a0f0-0231a7676cb2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400867, "uuid": "d237f825-6d2f-4fa7-b9ea-feaa3ad7b5b3", "value": "scan of order 2570.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2249891d-aef3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620364484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364484, "uuid": "a36bfa4e-d7ec-4d8e-85eb-5f9803fb59fd", "comment": "Malware payload", "value": "8c19d83ff359a1b77cb06939c2e5f0cb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364484, "uuid": "2e2a1ab3-0372-40b0-9fc4-a4880f23fe8e", "comment": "Malware payload", "value": "7baee22c9834bef64f0c1b7f5988d9717855942d87c82f019606d07589bc51a9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364484, "uuid": "74859903-2be4-407e-b2e7-9bac86d03bd2", "comment": "Malware payload", "value": "a01a199e6f6f3e84cef5c7e6251a2b1291217885", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364484, "uuid": "4218d6b0-aab7-4fd9-be11-bf8913653eca", "comment": "Malware payload", "value": "99428ae963af26f1db851ab6e5c2f53e83961969234e1a0b19a364a8311200d3a41af775496acde93daef781200e53ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364484, "uuid": "f4332ae5-f385-44fe-9996-b37d2a04f62a", "value": "3934235DA581D8B764A934534CAFAC473935D76E1B02A3F364B0207C2F8CBD5EB6A01B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364484, "uuid": "27d89d05-c142-43ae-b9bd-971b3de9a6b7", "value": "6144:HmbyEr/rerH3HOkzOBhVKaWcu4iXZrOBV:HEyEA+kzIKiu4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364484, "uuid": "7124a15d-8915-4a53-afb7-5af51227b83c", "value": 244784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364484, "uuid": "f73f84b7-cb76-47ad-a98c-ce9fa171ee03", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364484, "uuid": "4f23f3d9-2f66-4916-8dc0-c18501515824", "value": "kj.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b441861d-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620414121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414121, "uuid": "ac9dc097-91d9-4b6e-80d5-9e494c0893cc", "comment": "Malware payload (Dridex)", "value": "e2600fe0be97658a37270b980834b6bb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414121, "uuid": "fc5db46b-28ce-4d1c-8726-eb84d6bd99bb", "comment": "Malware payload (Dridex)", "value": "7bbf8cf0634527fdc9e6938bd4f277411b2b6e4c0c6d4ff959a5758c8ed9d6d9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414121, "uuid": "b5d9e691-9ebc-42d5-b5d0-fa3ce548c2e6", "comment": "Malware payload (Dridex)", "value": "82080d83fc663a010303c0fdfcdd36992fb7e839", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414121, "uuid": "364dfe13-fcf3-4683-90da-9e35cb3efcc9", "comment": "Malware payload (Dridex)", "value": "0a92771f4d6986e49d57f3913f44ee8bcaa9cc2cc7789c3b79c21677f41edd80cb83061d2ccbd8cd8c9fd156e99a8ec0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414121, "uuid": "b85d2e45-8536-4c0b-90c7-5d1a3d382e53", "value": "DEF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414121, "uuid": "3ae713aa-68b6-457e-984d-5e72424b04d8", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414121, "uuid": "230582e0-a2f5-4701-9f01-63287e05fc56", "value": "3072:SWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:S42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414121, "uuid": "9efaa898-3478-4432-a25c-07eb0547c07b", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414121, "uuid": "f2454b0e-947e-47b3-967a-43b29e08d13c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414121, "uuid": "6b57049d-6a2c-4dc6-9358-89d2bb962552", "value": "e2600fe0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119f57fa-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403540, "uuid": "8149242d-8eaa-4b10-839d-5300d511b17b", "comment": "Malware payload (Dridex)", "value": "13590cc8f31d1a06d73e7c48eebb3fb4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403540, "uuid": "c7e4900c-6a04-4923-be25-de2fec1e2fe9", "comment": "Malware payload (Dridex)", "value": "7bc39e9574b3ce72b39f1a729e4a2705e323b9b67af03b28e448335034f17198", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403540, "uuid": "1bbc96d1-163a-4ef4-961c-37670179f599", "comment": "Malware payload (Dridex)", "value": "70da916eb5fc3ca41680f1c03a71c36fcad961a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403540, "uuid": "7f9827b9-0ef8-4c21-8f3c-a6bca5d66b47", "comment": "Malware payload (Dridex)", "value": "3766478302670f0ea97e09868c1f744fd100979ff1bb0298ae14f8a4d71665ce01bfa214fdc8b1c237283bdf7aad7798", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403540, "uuid": "9dd8de23-0010-4bd9-8a97-dfc3e26ff9be", "value": "A1F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403540, "uuid": "94c4fddf-9ff8-4e52-a953-512d3cb633a8", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403540, "uuid": "4de6599c-0220-4a44-b7ba-4bc7b87c1d79", "value": "3072:hBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:/uXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403540, "uuid": "4095cc1d-fe72-4d52-8acc-3ba8a341b451", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403540, "uuid": "a9cf44a7-e99a-43d1-b054-ae2a96d97422", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403540, "uuid": "80391aa5-9f20-4522-8e21-3a6c36afbcee", "value": "13590cc8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16020ec-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620392292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392292, "uuid": "de4cf5a1-43c4-4c9f-b314-95eaef628acb", "comment": "Malware payload (AgentTesla)", "value": "d970a6c41ad353265611ac97a510c6dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392292, "uuid": "fed0e13f-e733-4b0b-a38e-6d8cff97aa33", "comment": "Malware payload (AgentTesla)", "value": "7caf472783f6662320f054d8d856229bc339407aab5f73a90d714563a3f030b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392292, "uuid": "7c839d2f-03a4-4483-b7c4-e8b320e07987", "comment": "Malware payload (AgentTesla)", "value": "271152640b34c48b5e1fcb0c32ff5132a93a3e50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392292, "uuid": "82c4d2ff-3d85-4d0c-ba72-24a18dd9e965", "comment": "Malware payload (AgentTesla)", "value": "83e80738f00781133d412d5232c6ce9808696ab09aae586fda126c817fe349e138f85929f0a8c03c3fca183fe5994452", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392292, "uuid": "89b9b402-281c-4015-9872-f335b226d744", "value": "5725F5993350F69EC8568836D9581FF4AA516C66F30BCE0394D33DADBA3D8D6CE140A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392292, "uuid": "386d1988-91b7-4acf-ba51-d891f8fe9536", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392292, "uuid": "321c759c-f7de-4a14-93f3-2effe3365aef", "value": "12288:tzmWAUqHp4/YTIDFQB0r186reKNZVu5l2i+1O8Q0w7IFzLrTKDGu9PkWZaoMEjwA:tzm19p4OID+eK6rewzlg8vwiK3tco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392292, "uuid": "bea9d5dc-5f12-493e-9a27-9ffd6ba0bf4e", "value": 1043456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392292, "uuid": "335623ef-96f8-4f31-8115-92975ed54653", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392292, "uuid": "eb54ce2e-ace8-4cd2-830a-def07b033eee", "value": "New Purchase Order PRT1542 SAP 15198539 SAMPLE DRAWING BKM-79483-9231.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f454905f-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403491, "uuid": "4b83ff55-e9e2-4926-9e06-7905284298cc", "comment": "Malware payload (Dridex)", "value": "b2feb35c2000e7f9f7a21df74a87879a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403491, "uuid": "644d431b-9a0e-4277-a1ca-df7803e73a1f", "comment": "Malware payload (Dridex)", "value": "7d1bc3e952e262814e82d9f2b069533e61cb5d930920089736aec1fa5f6bbdb8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403491, "uuid": "7dd9a48b-a0e8-4755-98d9-9121debb4185", "comment": "Malware payload (Dridex)", "value": "a8109c4f16e00c53eb169bbd0c92036a45dcf864", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403491, "uuid": "5db53820-9823-440a-b790-9e48ad016894", "comment": "Malware payload (Dridex)", "value": "4d6e5ba528401c848304b9adc7db807d7fee54873722d3ad422708df92442bb2a976ae5f89890877237dc1dc466b1f24", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403491, "uuid": "5645596a-caa7-41b2-a236-3fbef28723f2", "value": "6BF3C141C9C5CCE0CBE36C3A4795963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403491, "uuid": "6f61e015-e1aa-4fb6-9a5e-89eed2e700ee", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403491, "uuid": "05f61232-42c4-48e9-bebd-3cfb16ce49e9", "value": "3072:puFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+24:p0czbty9uiaJlP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403491, "uuid": "a7f90aa3-4e3d-4310-a2cf-6d58e99710e5", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403491, "uuid": "cffbb277-5fc6-4eca-8461-d144c987902c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403491, "uuid": "ad8155b0-5f34-4a9e-8684-a0441f4c1aa0", "value": "b2feb35c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a51627-aec7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620345700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345700, "uuid": "13b0bc89-11f5-4bfc-9ecf-0b076d644f2f", "comment": "Malware payload (Dridex)", "value": "0eda3fb9fba9f2f271d3ba8b5512f721", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345700, "uuid": "05a86e37-d662-4a36-83b2-a9f32f480e7e", "comment": "Malware payload (Dridex)", "value": "7d20679e68e149b69d36daa67c21d7da49cd6c88fdc5620a03660a4c9936f4bb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345700, "uuid": "f18ba44d-4151-4191-a9cf-ed67af981275", "comment": "Malware payload (Dridex)", "value": "db9a2c4c52d5fc8c9a66e019400a5bf31420baf9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345700, "uuid": "fe9b1159-d36e-46cd-9ece-501e9d9892f9", "comment": "Malware payload (Dridex)", "value": "ed83bd9f01add7c6445e0baf7d90f55a82efdd60b2a757e24c320b979c9c21e3478b5a88fe5a19b8939381a75b5c4bcd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345700, "uuid": "b40729a6-a03c-4125-9ad7-1cbc5616f100", "value": "A6F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345700, "uuid": "cbcb0c1e-5610-4689-8ad4-fa332b9247fc", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345700, "uuid": "4da83513-8f80-4e9c-8214-50f292267cd6", "value": "3072:1WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:142IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620345700, "uuid": "2c981f91-7b12-40c4-8557-b003cfe72468", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620345700, "uuid": "a3368ac7-1521-4fa4-8559-ad6145ba3010", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345700, "uuid": "32c790f7-ddc7-4651-9dff-249e9e1eed16", "value": "0eda3fb9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c127ad7-af88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620428441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428441, "uuid": "97bd7019-b7ac-47e3-ac13-802d9d85c42e", "comment": "Malware payload", "value": "bde03d5bdf1ae57a2ad398967a3735f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428441, "uuid": "282b5d47-9e9c-4c11-962f-3d6150340e7a", "comment": "Malware payload", "value": "7d76b0236eda358a05b75974667aadf3ebe8ddf263082b11b43e1448bd0d8618", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428441, "uuid": "e5059553-7081-48a7-93fd-568c58283ccc", "comment": "Malware payload", "value": "0e2cb225cce49ccbf9a469ea909fdf19892f4998", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428441, "uuid": "3f5eda80-8e6d-4c3a-9ef8-0d55071d3bcf", "comment": "Malware payload", "value": "013020d4c7082bf767d4ca3561ca0d9a244f1417fdd538c2364c192f0df00ac62a4445607585fb60f862f7f17f8a62c3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428441, "uuid": "9425c571-d0f3-4938-bd81-0328d4bcc0d0", "value": "FDF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428441, "uuid": "5aee56ea-7384-4dd7-b8ec-05c2db4473cf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428441, "uuid": "b566f821-dca5-4e8f-aa4f-594ff481eba7", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620428441, "uuid": "3f141d99-d098-4901-924a-5b0cdfb325f8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620428441, "uuid": "d1377ff2-3c92-4e0c-84f6-09ad61600492", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428441, "uuid": "ab11f8de-f2f1-4857-8f78-cdb75ddb580d", "value": "bde03d5b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbe9378-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407130, "uuid": "ba2dad86-aa29-48aa-b6e4-b017237fa7a1", "comment": "Malware payload (Dridex)", "value": "2b2f78aa643dd4630ad271148161848c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407130, "uuid": "442e790a-1aa9-4455-9025-a07177567547", "comment": "Malware payload (Dridex)", "value": "7dc3eaca2e90c73107edadaaaba9d87fe520b89e5142ee540350a647ae3a2bff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407130, "uuid": "b9bdaff8-cff3-44d1-b26d-45d766ef035a", "comment": "Malware payload (Dridex)", "value": "23d33df452563b950801bfb578a67638a92fb44b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407130, "uuid": "bcc7a182-68c5-48d4-971a-b9e4a09dcb56", "comment": "Malware payload (Dridex)", "value": "e803b201f0dbc5264b0a1859ad4123041c0a68eb35cfe6914daa1ed31269f66926f42293a295c4c098bc57c3d5869252", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407130, "uuid": "fd59afbf-c418-4dd1-be81-f8edc5220be6", "value": "C1F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407130, "uuid": "692ccdde-22d7-4a67-b27a-95061755bc04", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407130, "uuid": "7ba4903e-f6ee-4dd6-bb32-1c1bde282eff", "value": "3072:xBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:vuXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407130, "uuid": "c7e90700-45e1-4abd-9d9d-d4de2f07df21", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407130, "uuid": "de1b534b-2a44-4305-8eb6-460b888ce46f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407130, "uuid": "05ddba34-7b2c-4504-b54c-4bde10657354", "value": "2b2f78aa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76c3682-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407227, "uuid": "4a965637-da8b-43ec-9964-4fa6c41fbd5c", "comment": "Malware payload (Dridex)", "value": "12fc9b6dab5ab77f94a28b82b6ab9892", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407227, "uuid": "226c68e7-0c90-436e-8b57-c8c86dbfb584", "comment": "Malware payload (Dridex)", "value": "7dd95b92f0e7b2e7921fceef1bb9755ed20c5e59c52f6018f76463963db187ee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407227, "uuid": "b9884fd5-afa0-4578-8c7e-f027a80ad1f6", "comment": "Malware payload (Dridex)", "value": "c46985ed3d4508c41179835da4fa1aa824fae5a7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407227, "uuid": "b18b1ed5-614b-41df-9d10-5ef32753418a", "comment": "Malware payload (Dridex)", "value": "c291a5cd6f4148a7baeb3bdb84898a59aab42c27ef10eb70ffcc88492252ec7af7fa6f021a769e37f9066d7333789a27", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407227, "uuid": "8806c13c-37f1-4b26-99f3-bb24f97f7b36", "value": "BCF3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407227, "uuid": "4e0f16e1-8aae-4821-abc3-0f408f7b51e2", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407227, "uuid": "d47f0a14-50ea-4e30-b4db-22595b935b32", "value": "3072:iBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHqE:iuXLcclWEc2HeSjNjGdeKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407227, "uuid": "c8d30e1a-3cd2-4835-9537-e1a44c37859d", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407227, "uuid": "ef13155d-76b7-4fef-b100-04c26926d08f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407227, "uuid": "66c35722-cfb5-45dd-8ba3-ba79777e9f36", "value": "12fc9b6d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ce0487-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403956, "uuid": "053782f1-983c-48d2-bee0-08bb66fc1610", "comment": "Malware payload (Dridex)", "value": "da42437356255e909c37d75387deb4b7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403956, "uuid": "a16a7ec3-81c5-44f4-b8d2-0fff92a7a1b9", "comment": "Malware payload (Dridex)", "value": "7df422e336698bc5575e580d4deebbd91fdace22046c776d3757760d97f63bb6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403956, "uuid": "066b07a7-3191-44d1-b913-bb29a951ef82", "comment": "Malware payload (Dridex)", "value": "8a97ce96952287cc5402ffa9a8c4cb081a5a74c5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403956, "uuid": "95c2ae0e-61d8-4b69-83e7-6c17c7e93f82", "comment": "Malware payload (Dridex)", "value": "57c11da8d9d35287d9f9ee400218aecdd81e3ad2255db4e72e895cbdf3ed7f36748dd8d2c01be016c0b5ca5cb3980c5f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403956, "uuid": "c84f1cd3-de50-4198-9a9b-a2efd5380a24", "value": "A3F3D081E7CED5E0FC179B323EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403956, "uuid": "aa10bf41-dc3d-44a0-aece-1cd8dcca32fd", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403956, "uuid": "3ec38933-0997-4f86-bdbc-73a02bc65294", "value": "3072:fBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHaH:JuXLcclWEc2HeSjNjGde6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403956, "uuid": "0bf3b04e-e7ba-4efe-aa10-a112edf59c7a", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403956, "uuid": "f610bf43-862a-4968-97ba-6f14ab8c43fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403956, "uuid": "72d8c520-d132-4fae-8146-57ce0077839b", "value": "da424373_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4851eb-aeee-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620362489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362489, "uuid": "20eacf15-c45d-4dbb-a355-16206c58dc1c", "comment": "Malware payload (AgentTesla)", "value": "4d7fd81ab316988becd9d10e520ced98", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362489, "uuid": "d56200a3-22a9-4f54-9db7-81ec4895c347", "comment": "Malware payload (AgentTesla)", "value": "7e124e2b43350542e69a9a40e9c2f66ec43b54e155e54744b3c1f8ae0a87e6ad", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362489, "uuid": "28c47ff0-3c50-46ff-b7df-9e60856458ea", "comment": "Malware payload (AgentTesla)", "value": "8da0f5357d083bede5ed4bec3b2e390c53091fa8", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362489, "uuid": "f6d0409d-8a15-4fe5-9d1d-a41bcbb4e0e3", "comment": "Malware payload (AgentTesla)", "value": "f3ff0b3233a1ee21a8ad2548c3da35e49a0f27eee392132838eaf9d8fef37b1b34db2916892c7e3f2f14a1aeac214e4b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362489, "uuid": "431621ed-8624-4c7e-b618-9831342cb415", "value": "AA1533C26A742FF32704649BB6729FCDB21614E58B9E03543BF89BB0565AFC82C47D21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362489, "uuid": "51688523-6b4f-4ef3-8bd2-81692487e60d", "value": "24576:panddUAEDAh4RFFzZ5uGLdgUUGxtYt07S5mV/1lq:wddUAEDAh4rRZDcmtYtlIjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620362489, "uuid": "b097a171-4d43-4f8e-a13f-ae180550d36b", "value": 906563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620362489, "uuid": "43b5527d-c230-42fb-bc1b-9456f2e3254e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362489, "uuid": "84d03a1c-bff7-455f-a713-2f9251646824", "value": "NEW ORDER #776483 - Copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb105ab-af3a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620395242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620395242, "uuid": "d2ec85ce-522e-41a3-b5fa-85e19c465976", "comment": "Malware payload (AgentTesla)", "value": "aa6cbd9935ba7b6068f0ab94188a516e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620395242, "uuid": "4d937f59-3e3e-4f83-8106-470575dea2db", "comment": "Malware payload (AgentTesla)", "value": "7e1aa246e5ed02c2c9bd9fb175a973035e8ba0cd587e9c7f3b2e815017398c9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620395242, "uuid": "5eb8360f-562d-4f6d-8a91-9a35670f0954", "comment": "Malware payload (AgentTesla)", "value": "dd5623a93c1ab6a662dec3ea62226114de7d13cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620395242, "uuid": "a4e09d79-13ec-47ad-a842-9a450cf1e0a7", "comment": "Malware payload (AgentTesla)", "value": "e4cd322618f82ddefa414fbc22c07b302efbd31b46b5ceff8b75d423f595f70441496bc581388f35050fbe48783a9e61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620395242, "uuid": "5becf814-be0d-4fc6-88ef-3c647e55b7b2", "value": "4DF412AD17DCAB25CAFEABB566E180660AF5740BAD03E72D4DDCB4B154333408B853E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620395242, "uuid": "259d09df-fb34-42ac-aa4a-161dc3db548b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620395242, "uuid": "96a840c2-c473-4b49-8634-8e474db53de7", "value": "12288:msQ00vXXTTL8YipxU1269PXLCQAnidgnXofB58hp5MhCHqu9tA/4wTe7mkd8j24M:9Q00vXXTTL9ifoZbAidgnYfB58p5MhCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620395242, "uuid": "02f5ab34-7991-427a-925c-831812cf5013", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620395242, "uuid": "033808ce-f8f6-4019-81eb-d016af38c8ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620395242, "uuid": "79dd2499-b57a-4289-9f9a-991dbd775821", "value": "HOFcBrJ1WiSpxGb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235b4317-af3e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620396698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396698, "uuid": "6743e27d-fdf8-4825-8975-baff57968cd6", "comment": "Malware payload", "value": "0880c240dfc4e5961d6c6def6f0d6e82", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396698, "uuid": "cb8c45a7-2ca8-47b7-a36c-c5438363dc0e", "comment": "Malware payload", "value": "7e4904caa9efd47edce7355fa301db958232d7ec9d81fe7649a6404091791385", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396698, "uuid": "269725cf-3386-4397-b878-67521e021252", "comment": "Malware payload", "value": "ba54a1f97c0e5e9c1d61d0aa0ee21c33d47d914e", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396698, "uuid": "5956cfe3-d61e-4b36-ba7c-759b9c1fc502", "comment": "Malware payload", "value": "9e7173658328f8dbc56772d51d6768beaaf83f9bb0491f7774c200a86d5edf38e2a63fe63f2081d3e8075f965b18c3bd", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396698, "uuid": "f195c5f9-d8f8-47f8-a90f-d44972d67859", "value": "9151DB94D11848D534DDDAAE77BB945EDBD8C3CD126F0AAE88932C3DA000719D147DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396698, "uuid": "43db6ba2-6de6-42bf-a028-140148bd34ce", "value": "24:THa/cFnHreDcckwreDc+JQE/reDcMcxcreDchLfreDcmmKreDcZllLZreDcMUgrv:ba/1mIaZYA7GWWGRgwD9q9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620396698, "uuid": "999fa674-70c8-4b2b-b22d-edac557f21f8", "value": 3081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620396698, "uuid": "68b31e17-796e-4809-adf9-32f4309e3b87", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396698, "uuid": "bde04eb4-c5c2-4648-9c34-0ee02f6fbd1c", "value": "7e4904caa9efd47edce7355fa301db958232d7ec9d81fe7649a6404091791385", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c02d713-af46-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620400229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400229, "uuid": "f234dc8d-19f8-45f4-8c5a-4fe7590dbcf9", "comment": "Malware payload (Dridex)", "value": "909906cd30a05b778f519a53b1b85a7b", "object_relation": "md5", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400229, "uuid": "7651a473-a405-47ab-baca-ec93cbce3361", "comment": "Malware payload (Dridex)", "value": "7e8ac58c494d14dfeddcd46f67061c7a5a6277b95ab17ce4cf55ac839fd149d4", "object_relation": "sha256", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400229, "uuid": "44b7ea57-c259-489d-bb65-aac8c7918899", "comment": "Malware payload (Dridex)", "value": "ee03341352bebb9456f6c1c32ae2330703c674d6", "object_relation": "sha1", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400229, "uuid": "80e01785-7e18-4953-a22b-104fc15bdb33", "comment": "Malware payload (Dridex)", "value": "7cc3d82c824f75252ca3f05a9f23423b404070c47a68cdefe0deee7eb1c016e43791db37ae58dc4949cd1063647ea990", "object_relation": "sha3-384", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400229, "uuid": "404d8d38-9249-4969-89b9-d19e66c11a69", "value": "BD83F12D8039F8B6CC770A3DC2584F5B2C2B3FCBC4D02565EB62D46C1A45E5A868F6D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400229, "uuid": "07d3256d-f1eb-453d-ba54-95115cfa595e", "value": "1536:eiCWqHDV2b/uKBPQHioFrdnxlEZL4C+PvC8PCz5IuR2ZH7DuVrBJb5Kxcl:5EHDU/dPK7Rnwz8Ez5IuK7DuVQxcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620400229, "uuid": "81540dd4-9b9a-4edd-97e8-db51e94a35b4", "value": 88038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620400229, "uuid": "2d8c7094-792e-4111-8dd7-887443b59f4f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400229, "uuid": "9f8d80c1-f223-4d05-8308-d7d5a95635c4", "value": "order 387105.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c435438c-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403839, "uuid": "200e861c-0024-4a77-ac2a-246c1736e27d", "comment": "Malware payload (Dridex)", "value": "5e0e54080f40b78ca9e301d7a2549f8d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403839, "uuid": "af8909b7-9607-4261-bf10-ada21a53e9ba", "comment": "Malware payload (Dridex)", "value": "7e93c40661b4d6fc7a8d3e2a5ccc7e9959bff4e7a8abc495bcfaa12c4411d5b7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403839, "uuid": "5ea94c9c-5088-43cd-a2e1-84a1dc289467", "comment": "Malware payload (Dridex)", "value": "7f844bc056dc87ab86ac830e261f38392753421c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403839, "uuid": "384a5ae0-415a-4e7d-883e-207d14746ac6", "comment": "Malware payload (Dridex)", "value": "2552245df914af1f5e578e060c70777e68cd33e1dac0d2ee08508ba8f533ac35101988af769cc98bc1fa647e6d9959f7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403839, "uuid": "cb3d9199-0c5e-45f9-9571-8585e1b01840", "value": "51F3D081E7CED5E0FC075B333EA80EEF52310087691854E4EF29DABD96BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403839, "uuid": "cf895f02-9091-41b4-8a19-1b4f3293db4a", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403839, "uuid": "7f7ecae9-7d53-44be-aed7-f6c831f9b18a", "value": "3072:/BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eH2+:puXLcclWEc2HeSjNjGdeW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403839, "uuid": "089d7d05-18ec-462b-962d-3cf813e0a1f3", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403839, "uuid": "d4a6ef50-4e8d-4957-9934-375f59127a44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403839, "uuid": "2cdf8cf1-08d6-46da-bf87-a19f0a5101e0", "value": "5e0e5408_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0902d54-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392237, "uuid": "08e2fa2c-17aa-4005-b8b9-148be4dd18c4", "comment": "Malware payload", "value": "d9e6704741f7eebee858457d130d7331", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392237, "uuid": "94e88930-dcb7-4adc-ab55-4f979c2cd6aa", "comment": "Malware payload", "value": "7e985e1d7da081bfeb1848e8824637329c61a7ae06c0670ced2d63ea62e57be5", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392237, "uuid": "b3da8524-f2cb-46bf-9f35-93b5ea353bda", "comment": "Malware payload", "value": "86ffc26c8daec541c54dd41cff9ccae695bd9c9d", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392237, "uuid": "62707d1b-7657-4392-b195-00dcc9adb420", "comment": "Malware payload", "value": "0a4cb25d91b0f3d30ccf63bae485995b1a8f59287b8dd8a621c662815942731666cbcea0f630d174affc3b901f7f2bd2", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392237, "uuid": "8b92259c-7fe5-4fff-b3f6-0bc5fccd2a55", "value": "4CA1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392237, "uuid": "3384d485-f393-4b34-a833-47eecef44d2c", "value": "96:pRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:pRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392237, "uuid": "b3f80d49-778f-42ca-be41-e3c059813fdc", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392237, "uuid": "254a7d5f-b78f-4870-9d98-e445e429aacf", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392237, "uuid": "86b9bb8a-ae38-4f05-a5c9-ac0cdc0b4d56", "value": "7e985e1d7da081bfeb1848e8824637329c61a7ae06c0670ced2d63ea62e57be5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d50075-af7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620424864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424864, "uuid": "ea2f256b-175f-4e70-9ba2-514e4f1b8b1b", "comment": "Malware payload (Dridex)", "value": "a1c27fc59f2cc72c85c9391aa4c9c779", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424864, "uuid": "e4f3701c-d805-41b2-9fdc-782bc0bcafc9", "comment": "Malware payload (Dridex)", "value": "7ee2dc1dfe75cbdb96b049761ba786bf40e70040ba882b446bc152055d7651bf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424864, "uuid": "28767032-3c3a-4290-ad75-200f0678e4bf", "comment": "Malware payload (Dridex)", "value": "bf9cbd0828deebcfa0dbd482f8390bb363860a63", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424864, "uuid": "448a4fa6-3054-4323-aa79-e13f088691ef", "comment": "Malware payload (Dridex)", "value": "7ba3bc59d0a4b8f281913533259acbef5e2114244242ca058abe4056a99171430d8e99e46388951d15223966e58708cb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424864, "uuid": "899f04dc-08e7-4f80-bc43-99bf6e21300e", "value": "4BF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424864, "uuid": "83282a8d-86af-40db-885a-0089995bfbbe", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424864, "uuid": "b2bc4152-575a-4dd0-81a1-f46d69040200", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620424864, "uuid": "379eadaf-9763-4f06-89b0-c55935057fed", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620424864, "uuid": "3433f20a-238f-47ce-bc9f-7753ea7190c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424864, "uuid": "133b7ca5-17e2-487a-b00e-f76a4be9a546", "value": "a1c27fc5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2f307a-af7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620424875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424875, "uuid": "9f4ea125-4b58-4365-9a12-eed7e23361a9", "comment": "Malware payload (Dridex)", "value": "b0be140dec3161cd7a49d1b149c9a541", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424875, "uuid": "41330236-f6be-4ba8-9eeb-08be70edbeab", "comment": "Malware payload (Dridex)", "value": "7efa1489d2f834930c61f7dbcb3139cb082d0f9d67687d476359fecfff4d58a2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424875, "uuid": "1a89cdfa-ff93-4346-a1a7-0d39cad7dfc0", "comment": "Malware payload (Dridex)", "value": "455d6192642e6ce83afd797ea5904663cb90f820", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424875, "uuid": "6c4661ba-31d0-4fd2-94e4-9ce488ac8345", "comment": "Malware payload (Dridex)", "value": "68afb966476a77ff1536c6d4c6f522481d7b7c83a1596bd3ecf9224efbf20de6b89b71e562d0f171a07ca201300eda95", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424875, "uuid": "b6611f2f-33fb-4a16-a753-ccc8e8bd39e3", "value": "68F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424875, "uuid": "34d3bab2-6983-46ab-b898-35e9024e437a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424875, "uuid": "e7e75a20-ebc5-4057-8199-0ef13394c4b5", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620424875, "uuid": "53130b3c-6d9d-40c1-bc48-6e79752c0602", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620424875, "uuid": "61da9482-b018-44e3-9ac1-3f2226ff326d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424875, "uuid": "c31a7173-ac7a-494e-847e-ee505853bfa3", "value": "b0be140d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441a5270-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620403624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403624, "uuid": "0c3ab453-232d-4df2-9bad-56d655aac638", "comment": "Malware payload (Formbook)", "value": "0e0d5f9088ea19c58c3763c0ada56396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403624, "uuid": "7d6c3426-e464-4f89-800d-1dc2e5e6ff7c", "comment": "Malware payload (Formbook)", "value": "7f0511e940e8caa44c759e4696bf6b6b7f1389a2290b25c5e3f491270c63daab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403624, "uuid": "287f139f-b279-45c4-9285-786240566f8f", "comment": "Malware payload (Formbook)", "value": "cfe4ae26328d511ac04c2a51aebdb82ee463c0d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403624, "uuid": "e5ffb4e6-910e-4fb7-9836-d48a2a8822ea", "comment": "Malware payload (Formbook)", "value": "f2add6803774bbde10e0fabce8f07b038522aae0af290031a28e61b47342565e98322cb831b38e0a743ddd5e999b3ef3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403624, "uuid": "3bba81d9-beec-4e1d-958d-47ccdb6910d8", "value": "7105CF9C3690B98FC95BDE368E941C60AA60B47B470BD307A49706ECED0D69BCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403624, "uuid": "3e193d56-01c8-4ba2-8b77-31db48d01ca7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403624, "uuid": "6594e4c3-cf4a-444d-8a5c-c449306e1867", "value": "12288:0fvMP/vSkafVEIbfnvedQ1T0pw93MNIIgd8+QQcwrQ49eIJZpYmijcMvVXGwauHA:0feikWdedRp5md8zQscpFijc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403624, "uuid": "2f6ee1ef-4e88-484e-89b0-950bfc674878", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403624, "uuid": "09e1a468-3451-414c-8728-b15d3eca65b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403624, "uuid": "10adfbe7-8df8-4db8-a332-ba644273c156", "value": "987654OIUYFG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7010f28e-af0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620374492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374492, "uuid": "d5a88267-1b6f-4f48-aea9-f593e254e5c1", "comment": "Malware payload (Dridex)", "value": "3a6e912b6e0fbae273e0cd6fdfec6b27", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374492, "uuid": "553a48f5-e2fc-4e6f-9c92-9bae6d5dc48e", "comment": "Malware payload (Dridex)", "value": "7f21b83407862cc489b8beb10aa0f3c4f50c4fb239cefd16f44d042d1d69a9a3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374492, "uuid": "ca19aba2-6650-49b8-b8f9-b3243e9a8383", "comment": "Malware payload (Dridex)", "value": "28651206eaa9ac6e14a8e1986294d2937304af18", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374492, "uuid": "3de813af-000a-407a-8323-c600260942b8", "comment": "Malware payload (Dridex)", "value": "9eef3ab39993ba45e093c8125bf3347273295408045001c5f41dd7e883cbe8525555d86dedf730831bd781cc8568d165", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374492, "uuid": "6f017daf-b034-447c-82d7-18a80029ec9f", "value": "27F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374492, "uuid": "cd18bd36-8df3-4541-b88d-1bb825d66c56", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374492, "uuid": "469b19e2-6e43-4bab-9477-13de63833231", "value": "3072:LiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:oeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374492, "uuid": "29172ea9-3c54-4223-b9ea-795912b14fd9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374492, "uuid": "f218dda2-ce95-4597-b179-444db59f49c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374492, "uuid": "9c880a15-e657-48f0-bb03-86b9e31b185e", "value": "3a6e912b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d84b92-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403517, "uuid": "a3215502-f4e1-45cf-aacd-28a1a40c0cc2", "comment": "Malware payload (Dridex)", "value": "041c72cd837fd2a47f93a285009a3a1d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403517, "uuid": "d26546f4-e655-4c01-829a-5b5c9b45a1f0", "comment": "Malware payload (Dridex)", "value": "7f4959419ad5c741110669b95d09d2f31f8ff87aaa48605ccd1122c915eec568", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403517, "uuid": "39741ad2-7909-4203-820d-c273b81caa22", "comment": "Malware payload (Dridex)", "value": "665e3ba87ed0bc5d2f74942d223a56055c9f205a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403517, "uuid": "bc9b4939-040d-4c15-ba79-858ec30ed0ac", "comment": "Malware payload (Dridex)", "value": "a958de71a077d10b1a0648abfa44951abc4060e0170dd1a8b9c4e803571cf5fcb075a4a580f3a0644b034c971e73ec9b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403517, "uuid": "d1740302-5436-48c7-a30b-98f9bf317f55", "value": "81F3D141C9C5CCF0CBE36C3A4795963B3624B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403517, "uuid": "8cfaa0a5-1ac9-4805-92f5-58b646c89682", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403517, "uuid": "06040f6e-4a8d-4166-b815-6e6546c078cd", "value": "3072:QuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+l9x:Q0czbty9uiaJlA9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403517, "uuid": "ee9d96c2-2a9f-45c9-8a95-3734e4cc63f2", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403517, "uuid": "4d31c516-c77f-4d02-86f1-2707e677e9ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403517, "uuid": "86606cc4-c71a-48a5-8145-079452cd2520", "value": "041c72cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb10a99-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620414136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414136, "uuid": "48411a82-02e8-4c4a-9cf5-2a60a423f5a5", "comment": "Malware payload (Dridex)", "value": "e859d5a07ace631d9cc964220be21423", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414136, "uuid": "643f9c58-3985-4e94-b3be-b113eac2fe08", "comment": "Malware payload (Dridex)", "value": "7f7121e531d9c7ed69a2e5c87e4155de67f376fde2c67640fbcb365881b028b1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414136, "uuid": "a4b68859-f264-4af4-9f7d-f830da6ec253", "comment": "Malware payload (Dridex)", "value": "5569513fe077238868d519565958bc87a97006c5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414136, "uuid": "40b0dfd6-5ef4-4089-91c8-e76724d276be", "comment": "Malware payload (Dridex)", "value": "7f7ea028d0a5e43ec46165e90e00135863fbb355f8b6e9cf20441ef3c393556fe30ded95a59132718614cf49bbe3295d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414136, "uuid": "ce0220a9-974f-4513-b923-346e1faccecc", "value": "9AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414136, "uuid": "c32f0702-0ae3-43eb-a8fc-1d58b940bbac", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414136, "uuid": "fc12ad0b-9877-4cf3-845d-cfffcb70c006", "value": "3072:xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414136, "uuid": "96c1ee6a-c1b1-4037-8602-b039ccf9c188", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414136, "uuid": "26f35631-14a9-48df-a7bd-ef05b190c15e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414136, "uuid": "81f5f324-24df-4407-b6c1-70f1132a9712", "value": "e859d5a0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c6e8f3-af6e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620417666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417666, "uuid": "659f9437-eec8-4283-9d50-b179ffade8b1", "comment": "Malware payload (Dridex)", "value": "c6c408b94639ff8d4551f05003532543", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417666, "uuid": "7b817663-82e9-4ead-a971-083edeaaa9f5", "comment": "Malware payload (Dridex)", "value": "7f9255556f1ce779ca5790d79f7fc00739ea113ad5bf8518b0809b36667799f3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417666, "uuid": "7cb4744e-edbc-493f-9b25-0c34b683ac0f", "comment": "Malware payload (Dridex)", "value": "f9212f091e5dffb61092ef15fffd9d12eb299c87", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417666, "uuid": "9b9dc1bb-63ff-4890-99c9-a9172a76dc51", "comment": "Malware payload (Dridex)", "value": "a734110ca829f5237bcd00dd6757f38c7d1e7cd34e86a675599ecf4c4f7b16d8fcac1f6bb0a8a4a725264e0e56288057", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417666, "uuid": "53236e5c-1c21-4352-82e4-6be0b4c65b04", "value": "27F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417666, "uuid": "cec550d7-0369-4c70-8f1d-f8a99c3ca7d6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417666, "uuid": "50eac6cb-d815-4eea-9b90-915810b40033", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620417666, "uuid": "1b632df7-2b16-43b6-95f7-6c127645c3d1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620417666, "uuid": "38f8b309-53bd-4edb-bbff-04acc2033ce2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417666, "uuid": "896f066e-976d-41a8-883f-0812677afd23", "value": "c6c408b9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f884088-af04-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620371807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620371807, "uuid": "a60ca028-46f9-4780-9b78-fee850dd8153", "comment": "Malware payload", "value": "9a8f39ebcc580aa56d6ddaf5804eae61", "object_relation": "md5", "Tag": [ { "name": "Custom PSExec Server", "colour": "#5F35DB", "exportable": true, "hide_tag": false }, { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620371807, "uuid": "aede9f67-5a84-4abd-a882-9fb1d1280474", "comment": "Malware payload", "value": "7fbf9bfeb14aa50c1f563ea45ebb1fa5d2b7da6107cb6d5569240bee70313b58", "object_relation": "sha256", "Tag": [ { "name": "Custom PSExec Server", "colour": "#5F35DB", "exportable": true, "hide_tag": false }, { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620371807, "uuid": "91ea4aa9-d3eb-499b-bb24-4d4bf21270e6", "comment": "Malware payload", "value": "18ce2fe93c0933ac681c46485e1c18ceb584e67f", "object_relation": "sha1", "Tag": [ { "name": "Custom PSExec Server", "colour": "#5F35DB", "exportable": true, "hide_tag": false }, { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620371807, "uuid": "a1e3e36e-1ae8-4a43-97f4-a09ae791cc07", "comment": "Malware payload", "value": "04563ff6fceb0652903fae02091d8ac2f92ceec4608f982e04d4a846fb501e00ee4ca5d13eacb947de544feb9bb2344a", "object_relation": "sha3-384", "Tag": [ { "name": "Custom PSExec Server", "colour": "#5F35DB", "exportable": true, "hide_tag": false }, { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620371807, "uuid": "ba7b8afe-76d4-40a7-ba3b-991c6a555f38", "value": "11B25CA7BCDB4733E486C1B1A5F86A0BA5AF55220B3045A397505E4B2D393D0AC3F327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620371807, "uuid": "da5e22b6-6ce0-484c-8fd2-ac2774b5bb9a", "value": "27625bbd963124e7bd1ddf72aed155a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620371807, "uuid": "dc4a7334-2cd9-4f0b-8680-1e828674f995", "value": "192:WFfW/IfXNTTJ4mSSjftrQXtOqhbGKRVB8QmZBdZDKzxGhMiYILhHyN6m355xzmys:FA9TTJhjfZru2QmlYzx76yHzobxPqNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620371807, "uuid": "8e6d3c82-ca26-48d3-a56d-131d01bf7cc5", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620371807, "uuid": "ad78a766-4648-4acb-99f5-fb2017f48531", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620371807, "uuid": "f9ac8ad2-40a3-4f6d-9303-6f1f98be236b", "value": "7fbf9bfeb14aa50c1f563ea45ebb1fa5d2b7da6107cb6d5569240bee70313b58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fafb39d-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403993, "uuid": "c0fada44-47e9-41ce-a3fe-558dd8cac1c8", "comment": "Malware payload (Dridex)", "value": "59dc3bf8685adc766975d6f380171750", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403993, "uuid": "9798d980-5bb2-42ed-bc51-328d4e524fbe", "comment": "Malware payload (Dridex)", "value": "8032184fe9e43825e755ea195ec004e3e80bc96f184e21a8cc902e3686493f3e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403993, "uuid": "bab409c5-e6b8-4195-81a5-80da83ea39c5", "comment": "Malware payload (Dridex)", "value": "6286a0ac96f8b659b0429eed14366051bc6d9a92", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403993, "uuid": "7c8f22e0-754d-4b23-9515-3640e05e5438", "comment": "Malware payload (Dridex)", "value": "27654865dfe5854d599bdb13b34c3cef971e3bac405e886fc519417600288f14c72d91f269196c3eed83edae7f003eb0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403993, "uuid": "528150f4-df3a-4075-a7c3-7e4f1b2f0541", "value": "A6F3C141C9C5CCF0CBE36C3A4695963B3728B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403993, "uuid": "cbfd93fd-e28a-42b8-aa3f-e67ce5f60137", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403993, "uuid": "78f43b8d-d867-45c7-937c-5b44143baf0b", "value": "3072:tuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+zN:t0czbty9uiaJlGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403993, "uuid": "59d14a12-c5a4-4f9d-9c5a-fde33913ae1c", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403993, "uuid": "f1aea270-32ad-42ec-bc15-1080624b8955", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403993, "uuid": "f43e465b-581d-4390-b47d-c1558dff59b0", "value": "59dc3bf8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33f1219-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404240, "uuid": "c8781c14-3f09-4c0a-b9f4-ffcdb6d2e226", "comment": "Malware payload (Dridex)", "value": "8f0583e437b9216c235d5fcd981e99c9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404240, "uuid": "8a3bb2da-e5d8-4ad3-9917-88e0a727f756", "comment": "Malware payload (Dridex)", "value": "805544ea550e3f5b5113cfbd587d252480f8f69e14d53f27a65d6a87073e67e7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404240, "uuid": "8b23035c-fc2a-45f8-9e19-4a722e4199a7", "comment": "Malware payload (Dridex)", "value": "c3b197b8cf6935ba890871a2d67a6545b5d85318", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404240, "uuid": "9f3f97b8-bdd4-4f06-b35a-5d152ccd77a7", "comment": "Malware payload (Dridex)", "value": "3edcab2b1f0def6dfca6fa266dd914ab795597254e9c1c9b99447811449c70f7e7a25ef5bac9a98010aae5fb250955fc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404240, "uuid": "b0567f87-24af-41d2-bbf2-33babbfec20c", "value": "4EF3E081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404240, "uuid": "18cbc832-1200-49ec-8c9a-fd1043bbfcc8", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404240, "uuid": "19d2cfff-a32d-47ee-8664-6a54c11166de", "value": "3072:RBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHAh:PuXLcclWEc2HeSjNjGdegh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404240, "uuid": "5422b8fd-2da5-4660-9a1a-52ee6686ef92", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404240, "uuid": "1d2d3d77-dbd4-4b93-b3b4-cb076897a367", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404240, "uuid": "b007678e-84b0-49f8-adb2-8e564988bb9d", "value": "8f0583e4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ef99d7-aec7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620345645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345645, "uuid": "134e0f57-1dc2-4839-bd71-9333d3eab733", "comment": "Malware payload (Dridex)", "value": "701992dbba41eb66f8e4870f4bda2de9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345645, "uuid": "f8c0a05a-1192-4fa1-be2e-391c0daf8b3f", "comment": "Malware payload (Dridex)", "value": "80916459a385e4afdc7a7baacc7ed2f5f24163358c43591836723340da945047", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345645, "uuid": "3717d81d-0d99-4c4f-8215-fa466fffd4dd", "comment": "Malware payload (Dridex)", "value": "cef9f6bdf140c0b34b746ac30ae1868b564024a0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345645, "uuid": "8e7bcca8-1a27-4517-8e92-d0ea504381f3", "comment": "Malware payload (Dridex)", "value": "0f7da62401c30e06b3fcdfb3071752097996b44282a391b4a2ff5264fd9f4303281276eb4ae5456effc0b5fe4c4bcf14", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345645, "uuid": "d2eb14b4-50d1-44d1-9fe4-d07ab62a93bb", "value": "D8F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345645, "uuid": "0892b112-1e55-494c-88e6-832936d740ef", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345645, "uuid": "30943010-16da-45a7-9dfd-6e37b4e2d37b", "value": "3072:WiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:NeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620345645, "uuid": "abf69bb3-3056-4886-adfb-895a95df0190", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620345645, "uuid": "1b464162-73ad-486a-ab6d-2ee0759f8dcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345645, "uuid": "765848d9-d65f-4b68-b9c8-25d77c5244a2", "value": "701992db_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f815616-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407402, "uuid": "ffa8a319-77d0-4bf0-99d9-2ba493c98dbd", "comment": "Malware payload (Dridex)", "value": "30cc21881559ca49d86b8bc85a7f61f0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407402, "uuid": "37a7f69a-3926-411e-948d-29d32cb83883", "comment": "Malware payload (Dridex)", "value": "80a3bab59fdf0961487e3304ec04c8c6b9a9572cd35264d2914b30962ea28dac", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407402, "uuid": "cadee124-7039-4555-919b-98d9f121cc1b", "comment": "Malware payload (Dridex)", "value": "de4701f4be260659cef6ac6a780ed32348f8a970", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407402, "uuid": "f4ef6cb7-cd86-42bc-8511-620bf71c879f", "comment": "Malware payload (Dridex)", "value": "0fa9ff08a628474ccc35a9d64c676843c1dedc9e897912496e80c93d85ecb18203d134983d754daea3fefe1d7b69e6b9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407402, "uuid": "718dcaa4-a422-4100-b463-5f49662a0193", "value": "81F3D141C9C5CCE0CBF36C364795963B3628B941995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407402, "uuid": "19bec2ac-3d85-4261-ae69-9548f6d20976", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407402, "uuid": "5138f03c-d500-4164-98fe-bb8ded898950", "value": "3072:0uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+JU:00czbty9uiaJlcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407402, "uuid": "b37c8195-9f08-4fee-876c-7c4bf4cd18a3", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407402, "uuid": "d5a85ad6-aab3-407e-ab41-e28e3a8eb927", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407402, "uuid": "86db9929-ba57-4371-915f-7cc9f31abf2c", "value": "30cc2188_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87955e49-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403738, "uuid": "59248fc3-4d90-4bcb-a7a5-be5aedf14715", "comment": "Malware payload (Dridex)", "value": "df4349cdbea4ae0b53114c8238b5da86", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403738, "uuid": "15d25d17-e1ff-4778-8fbc-b404bd0e53d3", "comment": "Malware payload (Dridex)", "value": "80bc3b553b734c3777719ce705cd4bc8b8b1e40179a6a4a6adcfedfe9efd0acd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403738, "uuid": "64ec6cd3-0926-424b-802e-747f672a9641", "comment": "Malware payload (Dridex)", "value": "eed0e12fdc546552c9beaee7c0a2163c9689e830", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403738, "uuid": "ad4289c5-8a97-4e6e-b3af-49624595e938", "comment": "Malware payload (Dridex)", "value": "520341bbdb71fa4b5e5f0b4708d29f540ad73754f3e1fff8399fffa00fbb9bc19cef44d81bc21b68c027c3d12798f267", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403738, "uuid": "946ebd8e-3715-45b8-a752-c874f9a2aa28", "value": "E4F3D081E78ED5E0FC179B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403738, "uuid": "e66dee96-bfe3-4b79-8f4c-0cc110f9fc53", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403738, "uuid": "207a251d-0858-4659-9208-f7aec2af52d1", "value": "3072:PBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHgR:ZuXLcclWEc2HeSjNjGdeAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403738, "uuid": "cc520fa8-99a9-4347-9aa8-f124210a9c53", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403738, "uuid": "e92bb390-738b-427e-8b97-053302d32d2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403738, "uuid": "66ac40f5-06f4-4bf7-9cb5-45290c40a176", "value": "df4349cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a592e6-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404142, "uuid": "dfe9b375-70db-4c5e-80cc-3401683cd14b", "comment": "Malware payload (Dridex)", "value": "9990b75777a62fe3cc736eeab3593e6b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404142, "uuid": "5152a63f-15f6-458b-9719-de1c851cd091", "comment": "Malware payload (Dridex)", "value": "81677909d7c486bbaecee0a1a9769da72fbc8057faaf38ac22f86411361851a1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404142, "uuid": "58b4887b-01d2-4347-bbc7-a99fde27cee8", "comment": "Malware payload (Dridex)", "value": "bd0823a994d8f2c2d93807389100c5faeed65c7b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404142, "uuid": "741ff20f-879b-4191-bf91-778be73b5d1b", "comment": "Malware payload (Dridex)", "value": "7ea7a2192da9bf06ae007181a7595795d7c90d5ae8861d683f396676cdafecc22a0caf79ff04c5405f6d0e922625e068", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404142, "uuid": "bdcb793b-be97-4b7e-a7ea-ec3d9538bbdd", "value": "4DF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404142, "uuid": "0a32c20a-ca3d-483f-a71f-2c7012150969", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404142, "uuid": "615dbc3e-6205-4d4f-8762-a860eaf8069d", "value": "3072:sWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:s42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404142, "uuid": "a99bb012-63df-40cc-87b8-995e0d5dd431", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404142, "uuid": "8828f9a9-33e0-4468-8bc4-2cc37237e02a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404142, "uuid": "f4c304c2-2638-48e7-8969-69e2c0ee69fc", "value": "9990b757_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04cea3b-aee8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620360051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360051, "uuid": "9a0cb4c8-b950-49f3-a992-6d6124820cc2", "comment": "Malware payload (Dridex)", "value": "2ab9e0a01540c3badbb8f9a958889e62", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360051, "uuid": "0b78b895-5fb9-4e14-933d-30d9cb3864d6", "comment": "Malware payload (Dridex)", "value": "819431e1e45226e716fa740521dbdf59353dc14b33bbb692707fb3b016db70b0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360051, "uuid": "e275073e-5cea-4118-b30f-d9514063baed", "comment": "Malware payload (Dridex)", "value": "d5be84318e8622bd49ca1824aae177b8a15d1e5d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360051, "uuid": "269e2607-7936-4386-8962-7f74c0a1439f", "comment": "Malware payload (Dridex)", "value": "9f203ba4d85904e25ff19e4f61f9cd8ab54fff912636b1383cabb219d93e4c2525a83ec68641cf0d9218afdb7c766817", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360051, "uuid": "aacc385b-9953-427c-a8a2-310101bdf3d1", "value": "0BF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360051, "uuid": "2a56746a-1e8a-4033-ad6f-40217d4a3fa0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360051, "uuid": "522d49dd-40d0-474a-ae5a-ac5a85d68973", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620360051, "uuid": "d970dfde-94bb-49b7-9e32-d67ea9ad9c95", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620360051, "uuid": "58e6fb08-8042-4fd8-bf3e-696ca6662af8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360051, "uuid": "6fc4c81c-e532-46f7-bc18-d88b89c7776f", "value": "2ab9e0a0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c158abc3-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392238, "uuid": "6b63f163-0698-420e-b41f-d344a723f792", "comment": "Malware payload", "value": "74bb6a4fb2455d343f53649d72ab0a0d", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392238, "uuid": "e5fdfdb5-8ddc-4a38-91d4-ab5ca7fc6653", "comment": "Malware payload", "value": "822d98f9cf58e38069ae6cd7eaedd9966c417f0b637a2ae696df3340623cc2ed", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392238, "uuid": "d881eb46-974a-404c-babe-e802a812a27f", "comment": "Malware payload", "value": "26ef5b98d0f34a519a869976500059549f6090b0", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392238, "uuid": "d7a64962-382b-4c71-8c8d-0a3218215984", "comment": "Malware payload", "value": "e8926ee97fa03e8e4e3968d03ac05ef487a9f86da9ab1b9435983efe08068a20992c49d00cc7678f83f51d08d74bdd0d", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392238, "uuid": "9f2091ad-41bc-4e19-9c37-5220f2f59f25", "value": "1FA1F750112C1AB07346697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392238, "uuid": "1a997d79-7371-46ef-832e-e264e397defa", "value": "96:iRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:iRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392238, "uuid": "2c322ebd-05d8-4563-a884-f5cf1ed3655f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392238, "uuid": "be7be0b4-985c-4369-9d2e-496c27921703", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392238, "uuid": "eda1c307-0570-4c28-ade9-8b22d664280f", "value": "822d98f9cf58e38069ae6cd7eaedd9966c417f0b637a2ae696df3340623cc2ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f5fa66-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620392516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392516, "uuid": "b5c8fc12-645f-425b-892b-aaf529b946a0", "comment": "Malware payload (Dridex)", "value": "01a7c9413e2f0036973c3afdfd14afaa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392516, "uuid": "cd814374-1133-4728-9aad-1d122fef76af", "comment": "Malware payload (Dridex)", "value": "82383b05b50ec2e99c55c4a95ad8d2be9ef56e58fff1375fdfd98ad1825ed041", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392516, "uuid": "b388bdd8-efef-4814-be05-822e88ad8769", "comment": "Malware payload (Dridex)", "value": "4e0cb1c6edccc8d74183bc6c64ab3b64739ed59c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392516, "uuid": "5e23876f-c29f-4507-95f4-dac5d17b5888", "comment": "Malware payload (Dridex)", "value": "9a8b503cf6412a9465af3f161a6d77845f724c62a313c6e09a35d2cf7990123c5b21ccc087e5b7708f38bf26fcac658e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392516, "uuid": "9bc830ea-1126-4bc7-854b-a1435ed32e5f", "value": "7BF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392516, "uuid": "4086c803-637a-4812-a9de-92e97f32a71e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392516, "uuid": "5af105cd-6e4c-452a-838c-18123d2bdd27", "value": "3072:ixlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ixlo0gw4ZMypZp45g51aXotOxwVeXm7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392516, "uuid": "7d19a626-c014-4333-94fc-82570ae28369", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392516, "uuid": "23b529a5-822f-429d-8ae7-aad689362432", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392516, "uuid": "57f3ec57-b66d-4799-ac8a-5f7e59d8eb43", "value": "01a7c941_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9eccfc9-af7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620424921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424921, "uuid": "c8fa2b20-30f1-4391-b93e-c82ec1d26173", "comment": "Malware payload (Dridex)", "value": "031dd2000befbd4eb4ba0f267519315a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424921, "uuid": "c9a361f6-2413-459a-bb4b-7434d2e88fde", "comment": "Malware payload (Dridex)", "value": "824a27d6f2c9611d26f806ecf47200a1fa5859ecd689b7b6e1ba53c29e8132af", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424921, "uuid": "6c0ae83d-5203-44ec-ad58-2ffcc00db689", "comment": "Malware payload (Dridex)", "value": "c55ab5a4c10df7feaf8dee72877f91083d543b0d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424921, "uuid": "199392d1-40cf-4990-bacc-31a435afd3e7", "comment": "Malware payload (Dridex)", "value": "caa72100e62200c4c5d94e5e49932ec952938ee2079bd9e415989ed55afd917563ed6410446ef303a271404e2cb1ed81", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424921, "uuid": "e332f3f2-62f8-4899-93ea-b208c0139766", "value": "78F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424921, "uuid": "cf834f4c-53f7-4f99-ba0a-72396e0ab71f", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424921, "uuid": "3154cc36-4d83-4c24-a4fd-fbc4b9e34683", "value": "3072:WuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:W0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620424921, "uuid": "97e44e6a-d48d-4003-83a1-8457dd914c0b", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620424921, "uuid": "bcbddcd0-707c-4556-a2d7-51f688665b81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424921, "uuid": "2ab11d7d-a669-4968-9397-62e3be4f0309", "value": "031dd200_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83be341-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620414100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414100, "uuid": "4a96acbe-308c-4da0-a38d-eb2ed7ac5633", "comment": "Malware payload (Dridex)", "value": "24da21768a17d62aeb0025963825c489", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414100, "uuid": "7c3a488d-4e8d-470a-a32d-863cbb2eaa25", "comment": "Malware payload (Dridex)", "value": "8276301f69225fa5f9dc8b528a3216543803ebad091b13b5baae7740c7b95897", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414100, "uuid": "5a8b0765-7c90-4d2b-9263-d033e3790347", "comment": "Malware payload (Dridex)", "value": "e1e49734f104a1967006ea160c15b256caf8989f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414100, "uuid": "0f8d4c2f-c555-4f55-9e31-8eb5125952ea", "comment": "Malware payload (Dridex)", "value": "13946a5b059c688e5021f7fdd564c8037e1589c7859e930f22fcb47915e6b939ddd581a89f9cb66f7cd2e26a6847fa31", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414100, "uuid": "3c76619b-7752-4297-ac59-d164c32cfa1b", "value": "54F3C141C9C5CCF0CBF36C364695963B3628B941995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414100, "uuid": "736e87d2-7e21-4fa2-a453-d8bac3cae850", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414100, "uuid": "72cf6a88-f4a5-489c-91b2-dd2cc05d3222", "value": "3072:0uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+ke:00czbty9uiaJlte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414100, "uuid": "ea22485a-ff32-4bd0-94e5-8d7c998ecdfb", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414100, "uuid": "d367dc7d-4913-44b2-ae4c-df021ee15401", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414100, "uuid": "a8c01822-a35a-42f5-a927-0306614aa495", "value": "24da2176_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea64d1b-aef9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620367350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367350, "uuid": "33c7723e-3fc1-40b4-9a3e-a6706829244f", "comment": "Malware payload (Dridex)", "value": "b5ca8352084cd15632f1d71f9577a747", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367350, "uuid": "36c00cf3-5688-429f-82ec-fc3ce69bf4b6", "comment": "Malware payload (Dridex)", "value": "8283aa081212de428f5c83f4eb116214617fbfbd9fff95040136895116cb85b1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367350, "uuid": "4ce8abf0-a752-44ae-bbeb-23510e777759", "comment": "Malware payload (Dridex)", "value": "e78a7bcf39abe76036faa2f478f2c4096778c012", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620367350, "uuid": "3bbda167-2c55-4846-b81b-2adb0391aa03", "comment": "Malware payload (Dridex)", "value": "0957d7a4c93ed4ec7a83453bde41c0a39a12e07b72bf6b79b8852ea18a63ccda2347d01b077df2d8702499fc04facbee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367350, "uuid": "dafd6295-a293-4df8-84e5-5ead8eac24fa", "value": "72F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367350, "uuid": "8ac553c2-0180-4cbe-b251-b85bd794f85f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367350, "uuid": "ba7fccef-44e9-416f-bef9-5cb5dcd012ea", "value": "3072:/lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:/lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620367350, "uuid": "66529f7e-b4b0-41df-8bf7-008c9eb3c6b3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620367350, "uuid": "aa5a7721-0c7c-44a2-8d1e-02042446cd48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620367350, "uuid": "ff3543e4-e28e-40c8-ae74-3fa698294b05", "value": "b5ca8352_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761c5961-af0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620374503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374503, "uuid": "b0bbad19-1095-4a66-8631-01009894f072", "comment": "Malware payload (Dridex)", "value": "a49710bb808550641d7deb1e5bc79dc8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374503, "uuid": "cf87b827-b860-4019-a8a6-d8c028cf9fb2", "comment": "Malware payload (Dridex)", "value": "82e759b5c8647087b3cfb1ecf99faa48705002166d61ff15f33f41d7480a8ec2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374503, "uuid": "2ebfe26d-1b7c-434b-8f5f-a22ccd538ca2", "comment": "Malware payload (Dridex)", "value": "953577b4cf4ac6cb9407fa50fdd31ee7deedae63", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374503, "uuid": "1b560531-246a-4f62-b4d7-94d8ec9e1741", "comment": "Malware payload (Dridex)", "value": "ca3c8087221b8928701f032ec3dd07cf8d4b5e4aa4a72fb396f6541f1d90d25aa193c34d0fafaf724c254e8e0db1961f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374503, "uuid": "5017d8f9-406e-4f79-8d7d-49963e7e02a8", "value": "FDF3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374503, "uuid": "ad3d4ece-cba8-480e-8fee-92b6e84730a8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374503, "uuid": "73c6e9da-f138-43c6-8971-1dfd0eaddea7", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374503, "uuid": "9a76e946-4ad2-4fad-b7bb-d283651c58c1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374503, "uuid": "c3296e94-8f18-4361-969c-8bc6b7246ef5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374503, "uuid": "6c163f94-fceb-41e8-bc55-0ae2e9757187", "value": "a49710bb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676717cf-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403684, "uuid": "1a21de78-dfbe-4e35-a95f-a10a373324f2", "comment": "Malware payload (Dridex)", "value": "d7f85eebaf35bdf0365e18eabf8b2c9d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403684, "uuid": "5ab2e189-bd83-440a-b3cd-146b81fbd4d4", "comment": "Malware payload (Dridex)", "value": "830415219637e537416e73975df0163cb8535f6e09f93cebb3cd6b62f48ed6cb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403684, "uuid": "81bff20e-00be-446a-b5a5-28c739919216", "comment": "Malware payload (Dridex)", "value": "dc8e6726e11a657d62ea83df07a89a57922dbd5c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403684, "uuid": "d4e66e9a-3257-4807-ba16-7bf7b7e06cb2", "comment": "Malware payload (Dridex)", "value": "e100a3a9f3f96c89727cdd77849cba813fe6160272f95dcfd512a00fe119eb3aee45dc41cabe179226ab25edc88c0c8e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403684, "uuid": "215ee44e-66f9-44af-9dfa-1a7f9befb7de", "value": "CBF3D080E78ED5E0FC075B333E680EEF52310087691954E4EF29DABDD6BB7E15164614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403684, "uuid": "372ac4bd-0dbe-473a-b799-bd18764816dd", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403684, "uuid": "99598142-a897-4784-91b8-82477a52fb9a", "value": "3072:EBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHj8:guXLcclWEc2HeSjNjGdeD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403684, "uuid": "5ab324c4-573b-46bf-af9d-936b58a141d8", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403684, "uuid": "b3b077d0-c8f6-41cf-9a29-21b4705b3adc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403684, "uuid": "ea3da2b5-f048-475b-8cc3-981f4d58b83e", "value": "d7f85eeb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db451549-aeff-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620369948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369948, "uuid": "e6b0548e-f25e-4a3b-8554-da11cc291d3c", "comment": "Malware payload (ArkeiStealer)", "value": "1e71c4226abc0bf88c58a7034382721e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369948, "uuid": "afbb39ec-2eac-4978-8af6-b265ac420d72", "comment": "Malware payload (ArkeiStealer)", "value": "8384bf259027068ccf870fac6975c718c82e357ee8a55af7769544809574cee0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369948, "uuid": "e3755685-dd7b-4347-b6e4-c3b76f3ae081", "comment": "Malware payload (ArkeiStealer)", "value": "5df292f0433d7dbd56751a557ef5013984e64291", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369948, "uuid": "50b248aa-a4ab-41ce-90e0-c8daf14b6230", "comment": "Malware payload (ArkeiStealer)", "value": "e380e3633e4e2f7f37238ca926001e367729a6716028c1b8ffcd356a16684fbd46098e1879f68533cbe5a1798e001012", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620369948, "uuid": "85313a52-42bd-47d4-adb5-92c615393945", "value": "C1D4E030B6A0C035E1F711F448B5B2BCA528FDE15B23D0CBA2D57EEA26346E5AC31657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620369948, "uuid": "970a00c2-f461-484f-8423-3f09683ebef3", "value": "3859d82b882d7140b7db7bb274c90a75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620369948, "uuid": "329ee440-c769-4a6f-bb01-128c2797c2cc", "value": "12288:cDiMFLf5JCPwH+LYi+cvCBBk34LJi4wr3CmtPuyj7lb:cDrLfxi+MC2Z4g3CmgC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620369948, "uuid": "4ec6779b-175e-4fda-b6d6-f2dde3229f60", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620369948, "uuid": "6d4be0c4-d8c4-48e4-b8d1-4a87b7a817b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620369948, "uuid": "fa9e3cfa-66d1-4b7b-986a-ad90cd4f77ac", "value": "1e71c4226abc0bf88c58a7034382721e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60416b6f-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403672, "uuid": "ee4a2e4d-c774-4050-84bc-0d0342bb512f", "comment": "Malware payload (Dridex)", "value": "7b153189ced48845ba69fe1fe187c47d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403672, "uuid": "e0fc4c87-ca62-4ae1-a44e-027ad2334c73", "comment": "Malware payload (Dridex)", "value": "83a54f12c0c36cb2711e7e155bbd8ff6dddc5bd9e64618213829f55776446549", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403672, "uuid": "1a1ac7bd-0a69-4e21-a463-96832e1bf4cc", "comment": "Malware payload (Dridex)", "value": "1e2fac671d1dca4c8db1f54943fd98d839cf1015", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403672, "uuid": "170928c0-be6e-4766-957e-7a4ddae36a53", "comment": "Malware payload (Dridex)", "value": "c21b5b0d304fd338b0cdf7161566543d18717dfd04bb47d9938cd0ffe1d83ae7def65d6b6de4ccbe55fbfbed394ae92a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403672, "uuid": "12fb21b2-c81a-47b0-821b-b55a9f260fd1", "value": "B4F3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403672, "uuid": "9db2236d-1cf6-4f5a-b106-5249fbe7e440", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403672, "uuid": "a753f43d-0d80-4169-b7b2-7aee2f895b7a", "value": "3072:bBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHSa:duXLcclWEc2HeSjNjGdeya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403672, "uuid": "58246791-728f-4fcb-adaf-d43666f294f7", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403672, "uuid": "38377fe0-bbae-4a8e-b759-6ebedb53dd24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403672, "uuid": "6af0acf7-9e66-42bd-a89d-9d6a509e3058", "value": "7b153189_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031cb02e-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner)", "timestamp": 1620392349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392349, "uuid": "e66515e6-7b00-4cf4-ad69-b369799eac86", "comment": "Malware payload (CoinMiner)", "value": "8c7dd09efc79198a7896fa5b659e776d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392349, "uuid": "305a3174-506c-4f5e-8460-91543629c16c", "comment": "Malware payload (CoinMiner)", "value": "83c4ff76659aec8db03942b3b7094736e4377048166839d3ab476067fbc2f892", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392349, "uuid": "355e3fc5-359b-4159-9be9-c17d0c7fe803", "comment": "Malware payload (CoinMiner)", "value": "4bf89db02da1be55a9d265d5c4ddffc837cff319", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392349, "uuid": "bc074d58-96d0-4b7b-a8fa-00336991629a", "comment": "Malware payload (CoinMiner)", "value": "e300562bd5f509414676c87fe5e98d5f0fa89d761e6e68e261f9efeef1f105307a39ec7f672e5bdf8cad11f1a2cfeb54", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392349, "uuid": "3e1268c6-0e2d-4baf-8eb5-e397dcab511a", "value": "8E85337AE0764D92D217073FB94A0A4AF2E77F2B70484DDD01BD6B22417BF21B1706A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392349, "uuid": "d489bfa3-b6c6-46c7-99b7-b951adbd6c40", "value": "406f4cbdf82bde91761650ca44a3831a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392349, "uuid": "823e6f7e-9a83-4c80-84d2-a44004985b3b", "value": "49152:EYzt8X3ynuZJ+ylANb03jgQu8oi51+ez/ELv:EWiebOUHiL+0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392349, "uuid": "555a98c4-de6f-425f-9c6f-5b0b78a86635", "value": 1713152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392349, "uuid": "796c3a9e-b00f-4d1e-94dd-be7a2ef825fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392349, "uuid": "d4a81e26-b5c8-4c99-bfa2-83d2ad8943f3", "value": "phpguard.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ca1734-aecf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620349247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349247, "uuid": "f4a15e25-6fac-47ed-8609-1d4e42b3f84d", "comment": "Malware payload (Dridex)", "value": "c7415acde405b8da19fe269a3f3c6fa1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349247, "uuid": "c7578fe9-bd1a-4347-8bc4-40d4b4ad0104", "comment": "Malware payload (Dridex)", "value": "83ec1728362e80185a5a18ae5274b0b2919eaca4779b16a6219ffab74c84a1aa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349247, "uuid": "ed244626-9836-41a0-9c7d-7f2273f8fa34", "comment": "Malware payload (Dridex)", "value": "221aa0dd22a9b4f1b16e8ed682f0e46e5f349170", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349247, "uuid": "3b1e31a1-4d8d-41da-895b-608300bf042b", "comment": "Malware payload (Dridex)", "value": "1f4d63fb988bb876c3e53547a2bdee15f5f570c5bf922808f216442b94469e2f3981c2e2e83e6abd8652c760c17b438b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349247, "uuid": "0e61d02a-f61f-479f-81a4-68966d7d3f46", "value": "4AF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349247, "uuid": "28cc1a45-82c9-4c08-9da3-a66135961c8d", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349247, "uuid": "8c09c8a7-1650-4e04-a38f-2a97cc46edac", "value": "3072:kWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:k42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620349247, "uuid": "59060774-3927-49fb-995a-8f7de56ae9ff", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620349247, "uuid": "20afd021-e168-4afc-9e16-5179ef708bcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349247, "uuid": "867e10cb-30f4-4c44-91e5-1eddcdbd0a0b", "value": "c7415acd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ceb7d1-aee0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620356493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356493, "uuid": "09bc4e7e-8bf5-490b-8dbf-54be998d42b3", "comment": "Malware payload (Dridex)", "value": "2738ddb10a2786f106e87835526b8cf3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356493, "uuid": "0d5aa7be-1c46-4f89-aa69-67edd76e548c", "comment": "Malware payload (Dridex)", "value": "84088c47c48907b91a8ec938fde877a15521408bc9675ffd75a176a3282cf4cf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356493, "uuid": "b1051f84-65c5-4f36-ad9b-4cddcf560da3", "comment": "Malware payload (Dridex)", "value": "40242d89e0a067d4fc82947569897c2d8ea4ae52", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356493, "uuid": "007c826b-ee84-4707-80eb-440309ef7371", "comment": "Malware payload (Dridex)", "value": "411ba26df0c5c7ea1ad80688d23cdd6a1460180d15ed780f274360c8a3723c5dddbe3f7cc46b69189c62b41b67fea279", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356493, "uuid": "1993568c-cf8b-42ac-b910-98e43728a1cb", "value": "31F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356493, "uuid": "5ac39bea-d136-480d-9dfb-b80ebd91b367", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356493, "uuid": "632c792c-b65a-4570-86cc-5619c33b4d88", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620356493, "uuid": "ea5e6f03-cbbf-4294-8c4b-4af2f2cb088c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620356493, "uuid": "b7f98918-64cf-4f11-a944-86a7c8e9c983", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356493, "uuid": "3a3a19c7-1fcf-40d3-9549-aded42d6f04e", "value": "2738ddb1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c3fdb6-af0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620374500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374500, "uuid": "366e4ef7-00ee-4f83-af63-e23907b481b3", "comment": "Malware payload (Dridex)", "value": "e07c2cec1e4f89ff29064e813a09fa2d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374500, "uuid": "fdf139ec-a73e-4103-8cfd-5ea60de6ba55", "comment": "Malware payload (Dridex)", "value": "846f09b29c4fac4888b8110fd277eee5da72da47da2f416ebb0040a716469765", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374500, "uuid": "32c4359a-8baa-4028-b917-11dc0620cbab", "comment": "Malware payload (Dridex)", "value": "ce0e6ea8ed2a7360e4aa0993bb23e329032a89d2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374500, "uuid": "5d155496-8825-495f-92b6-b307e7f175ce", "comment": "Malware payload (Dridex)", "value": "d7ed2807a4fcf0e8b8ae83792a95ad62718d32daa5426b77f1fd54006c888f61e23ae6676bdfbd3ef6bbba3e28c186b7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374500, "uuid": "14c32b4f-9dc6-4fa7-b494-81de35fabd32", "value": "7FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374500, "uuid": "db31e60f-fb67-4b10-a5d0-44fc1c2f14e2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374500, "uuid": "1ee9ad32-9eb7-4b14-81ad-1729100c9667", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374500, "uuid": "78afa246-6693-4220-8e14-6013cdaee87a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374500, "uuid": "2d75fc06-48af-4d09-8fa3-3062f8aaad7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374500, "uuid": "00a85d71-028c-4dd8-b8c7-578d67a83082", "value": "e07c2cec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a790a9-af7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620424909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424909, "uuid": "e252bb9c-837a-45d2-b91f-174915332213", "comment": "Malware payload (Dridex)", "value": "37b8fc9662521210f03152c85c2b0a9f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424909, "uuid": "15a664e1-ba0b-4c6d-a0ac-60c5a0068266", "comment": "Malware payload (Dridex)", "value": "849c72ddad6391390e109e40163374a95b836a5953c5ff1cc02e0845f6607672", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424909, "uuid": "dcb0b1f7-979d-47ae-852c-1a5231e8e1fb", "comment": "Malware payload (Dridex)", "value": "cc0695c6f290aeb3e367e8b8ce0ce6c4afc3c2b3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620424909, "uuid": "ddedd76e-7f1d-43b5-9658-342033dc4c1c", "comment": "Malware payload (Dridex)", "value": "aac2e238afddc1311622b4b7863dd44c23a7058a2264c061639d769e91b4db64311b3de691422479423072d87194a896", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424909, "uuid": "0fb55570-c17b-4002-ad8d-916290f8417f", "value": "C6F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424909, "uuid": "5f86c2e6-882f-4ea6-bd31-233764d58b10", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424909, "uuid": "aea89248-e165-4cfd-9751-b1ff81754c88", "value": "3072:ylpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ylo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620424909, "uuid": "c182d44f-af3c-4987-828d-708d4e9bcd72", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620424909, "uuid": "d2036b33-b2c7-4c79-b3d5-27c7217c8123", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620424909, "uuid": "908fc417-42d9-4cf3-855a-088c953fe979", "value": "37b8fc96_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9630fd09-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620414070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414070, "uuid": "d4cf8da8-d956-4320-90be-b8eb42260f41", "comment": "Malware payload (Dridex)", "value": "7fb96e22a2b56c16772a9dcd0d363819", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414070, "uuid": "59ab20d8-c264-4c48-a0f3-0cde6c6df529", "comment": "Malware payload (Dridex)", "value": "84f8be40af4580e9484b7e9599dfa3b25bf98fb6388c3b71e17b649354f80294", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414070, "uuid": "d6d1492f-6e05-4d87-b72c-a9d7c704139f", "comment": "Malware payload (Dridex)", "value": "a4b40e2bc58ba6a0814aa425b7ffd2b08c07c9fd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414070, "uuid": "0da0d7b6-7bf2-4c95-91b7-aea8cfc556a4", "comment": "Malware payload (Dridex)", "value": "1aee5ad08fcfc45667f4b224dd28fb1aa5a65ffc932ae6438c2679cdd5c5a9bc21b0105081de54113abddcb717eacfae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414070, "uuid": "5198e1c2-c9f8-4466-bbc2-0a17c00c48b9", "value": "5EF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414070, "uuid": "00c4a996-a6b2-4171-a341-637697adc7e9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414070, "uuid": "bbf22e9b-72a7-4e6e-9732-e06244807691", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414070, "uuid": "02000502-497e-44d9-b726-20c53225f905", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414070, "uuid": "1d495f55-f08c-4d23-a5fb-0706e2677c8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414070, "uuid": "5e9f9938-1f4b-4370-9c42-0dd1f985075d", "value": "7fb96e22_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3006326-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403488, "uuid": "6fe55fe3-27ae-444d-8f3e-bfff7901461c", "comment": "Malware payload (Dridex)", "value": "211cf74c8cbf321764b79bdf16affe3d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403488, "uuid": "75e0ddac-3ed9-474a-9aab-b1de63c3d5ba", "comment": "Malware payload (Dridex)", "value": "851d5690152b83b5c569678d15cac923dbccae114543c3917ddc1d1e907b421b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403488, "uuid": "e9b5215c-ffa7-485b-9d00-09229ea436e5", "comment": "Malware payload (Dridex)", "value": "28d496c2ebf476d464a11fbdb89e6f22f7537dab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403488, "uuid": "a7b4a148-3401-425d-9aa4-03bc30c1ebb9", "comment": "Malware payload (Dridex)", "value": "67654d259339ec7fd3b9f5724b1cff0a9d1017b1594c781ca7fa2a5d9ed6b9f2e31c98abdc4054d2e4e4fe5f0d52cbc9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403488, "uuid": "3a668c2e-d3f3-4045-a611-114a6a826879", "value": "9DF3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403488, "uuid": "a6050c16-f286-48e5-9e55-7b58b007471b", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403488, "uuid": "6c973211-b34d-4709-bf29-767b5fbb4e53", "value": "3072:TBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHC/:FuXLcclWEc2HeSjNjGdei/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403488, "uuid": "b2764275-92a1-495b-bfcc-738b574eaea6", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403488, "uuid": "4d70343b-45c6-4815-a3a6-e6fb484049fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403488, "uuid": "f4c52b52-0e02-4dc1-8366-70f89656fbe5", "value": "211cf74c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1732c5-af01-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620370864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370864, "uuid": "3f4c0a38-e390-418c-bf91-73607d8d2703", "comment": "Malware payload (Dridex)", "value": "e435c3dd1b0a5271c9c06b8b1fc44427", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370864, "uuid": "f31de770-bddd-4a92-8188-9994b646146c", "comment": "Malware payload (Dridex)", "value": "852dd52986686cbfc248bbc0f2600d4a656ebd8eba0a318882462e5a49fd09dc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370864, "uuid": "d9507c8c-d419-4c38-8b58-7784a316c2ff", "comment": "Malware payload (Dridex)", "value": "c22743d05f563b3f813e9cd860623aef18799971", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370864, "uuid": "0373e5f3-c0fa-495c-9109-2bbea2b0197c", "comment": "Malware payload (Dridex)", "value": "e1ea43b83d5ff557780181ef991257eb43f0a9b80c43878d73cc9d9d0d69a72f9b51ad1322fccb7f2e5c9afec37787f5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370864, "uuid": "6b666c03-645b-48ef-99cf-d02a88fd8253", "value": "E8F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370864, "uuid": "f7b9a248-25ec-4f8f-92c1-06c0760cba84", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370864, "uuid": "9f382526-7df3-4fd5-917c-aff908b03868", "value": "3072:kWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:k42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620370864, "uuid": "43a78675-3a5a-4ead-a97c-338bf364ba31", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620370864, "uuid": "62452606-e751-48da-9830-8703f9c01185", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370864, "uuid": "6a6a04e9-9e25-4257-99d8-0fe847ce05ca", "value": "e435c3dd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c811967a-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620404275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404275, "uuid": "426cd641-fe56-431f-a623-6516dbf29a7b", "comment": "Malware payload (AgentTesla)", "value": "2fd6de2f198347655f999c12f044bee7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404275, "uuid": "76fdf432-efc6-45a3-9be5-5cf3aa04bce0", "comment": "Malware payload (AgentTesla)", "value": "8566604577643c46d6ab84eeabd4d02fd6415186af787c9faf955493a1bc4647", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404275, "uuid": "74994e01-9bc4-44b3-a42a-c1fc721720d0", "comment": "Malware payload (AgentTesla)", "value": "a11658c01b5b1a5b1f8d24aa5e7fd6a541fd051c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404275, "uuid": "4fdd57a6-5a4e-4fe1-b75e-64ac90a79634", "comment": "Malware payload (AgentTesla)", "value": "0f57b60f6296b2cb34e0a017f2bcc7b316b237519a08b7e341b89e557cdc89f8681a71f0470be7c3eea8eeb6f2210af8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404275, "uuid": "76074161-94a4-4899-adad-1177e264948f", "value": "D7D423F4B4989969D643C203B83CDBFED8B164BEA10A5653C08F621DF6F9578B01F486", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404275, "uuid": "9e0a35cf-ae65-422e-8858-e9d535c5e0bb", "value": "12288:DgC/ZVIfPyD9FZRPy970RWaWM3va0cmslKxMGV4t7+pwyS6UWem5QN8K:DgCxVuPyDzZRKh0UMy0TmTtiayLrZ6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404275, "uuid": "7340dee5-6ef1-4f82-a338-012a61962e5d", "value": 650001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404275, "uuid": "5b086b7e-1bda-409a-a806-d153d18eab7f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404275, "uuid": "11e0f9fa-123c-49b6-9879-370cb2ceb40b", "value": "2fd6de2f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27ef4b8-af2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1620389663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389663, "uuid": "8f142d61-4279-4605-b499-1f4d3f5bb0da", "comment": "Malware payload (AveMariaRAT)", "value": "3ab2ef437054eab9c57e9b8bfb02f2d4", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389663, "uuid": "a1045735-45ae-4d65-8482-29c5748161a3", "comment": "Malware payload (AveMariaRAT)", "value": "85676ce2ff8483e0e6167360c33caf0e023e5d51d236eec49f35a5159787ed4d", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389663, "uuid": "523000f0-413a-4c52-beed-8afef63b65e2", "comment": "Malware payload (AveMariaRAT)", "value": "9c6b98e4362dc6aa752195aa4504fcb96b6f01aa", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389663, "uuid": "565d8073-a46e-4cb8-8555-8b959d54f3e5", "comment": "Malware payload (AveMariaRAT)", "value": "23126778598a710254b8f65cdf3f2233a7741d4019255a023b576ac3287012e9d7a30710ae0bb6df3620e6b8788ab6a4", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389663, "uuid": "c71d0516-2972-4de7-8da9-bffbbe71b40e", "value": "9C0533C839EACD200C653DC1A2AD51CDCC5331A93D72873E1372716A787E9643ABB6E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389663, "uuid": "34f28126-5dfb-40e6-a9de-071c2ee7d74e", "value": "12288:qU4QUoZaCf9GO0YE40IplI1nbmLnE+B4WeFICMSZHv68WLYjfsuO4IySdrG1tFR:14cf9GhjKLnE+LCICMcfZ3c6nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620389663, "uuid": "25af5588-b362-4ed0-a777-149c72c5f9df", "value": 868453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620389663, "uuid": "611f5a09-7b82-40e9-8ceb-509111bc0059", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389663, "uuid": "d4ba05db-9c05-44e0-9334-c8c958e42158", "value": "oder mcdq.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdff3009-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407265, "uuid": "9af7ad93-7369-44bf-9862-8f6ada1667c1", "comment": "Malware payload (Dridex)", "value": "6b52d0cb9b8159f8791f349a62cef4d7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407265, "uuid": "1ae81a11-e492-4a3b-965c-add2f0faeb4a", "comment": "Malware payload (Dridex)", "value": "857c7cd438697b90f4802aabf660b32ff017aa78cd7a2f0fa3a71fb9b9760db5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407265, "uuid": "f457ee13-4b5c-4c44-b1ab-2b8a5aa646a7", "comment": "Malware payload (Dridex)", "value": "b937c3cedfad2c49d54b52f3761b3e4f87dc322b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407265, "uuid": "fbe17517-42ae-4ba8-906e-2eac1eb83c32", "comment": "Malware payload (Dridex)", "value": "cff90001e5d9887c7ab9016d297af3bb6a9ee157910911d177512f22467158c7284f7c51e9241734692ccba5843b3cb3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407265, "uuid": "fd1d16d8-26de-49bc-94dd-9a8cd42474e4", "value": "C5F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407265, "uuid": "c43d5486-0e1f-48ed-bbdb-6d638ec15ede", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407265, "uuid": "9d0360de-4041-4a8f-8a41-89c3482725ec", "value": "3072:wBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjf:EuXLcclWEc2HeSjNjGdeDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407265, "uuid": "c07e00cc-348d-4e29-af1e-6cf9ba9584de", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407265, "uuid": "b263a0db-32f4-4d16-8d91-528787c95d7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407265, "uuid": "28d51635-d1ee-4b51-951b-18468b1b9b25", "value": "6b52d0cb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afafb82-af0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620374484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374484, "uuid": "03e56b7f-5acc-473b-a31d-0bd1b094f47f", "comment": "Malware payload (Dridex)", "value": "120fb0b5c595d155ef4f2da0ce230942", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374484, "uuid": "2435622d-3652-4595-891b-9680efca9191", "comment": "Malware payload (Dridex)", "value": "8583075f21e4cabcc96f985dedfa32bc77d869dc418ad16b5aaf3cbc977f2798", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374484, "uuid": "270bc193-69a0-4a57-ba06-5f9e0e1b9b48", "comment": "Malware payload (Dridex)", "value": "446bb3f30b02c4957fec68ee63207ddf6a0fe7c4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374484, "uuid": "0d985323-7e7f-459a-bc12-1f6bf8967b91", "comment": "Malware payload (Dridex)", "value": "48cfb54414f1dd0950367618f1460ad0427ed3efd4a4f078b5c4e2c986b9c0378aacec15e4722c298ac288e57d269ba5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374484, "uuid": "4ef44096-adaf-4454-88b9-0bfca0ad85fd", "value": "54F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374484, "uuid": "9d43a432-edfa-403e-89e8-94830af70146", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374484, "uuid": "ee318d44-fc47-4d34-9d6c-5088c404b2cd", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374484, "uuid": "c7f9175d-7537-40a9-afc0-5fd74b5ddc59", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374484, "uuid": "7507bdf4-9304-4a8f-a2af-cef4d44185ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374484, "uuid": "98351e7d-50f8-4eac-8d22-902de0123b49", "value": "120fb0b5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c0a164-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620403765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403765, "uuid": "13ffe5e6-8b18-47b1-bc1b-956995d15c7d", "comment": "Malware payload", "value": "9e7d034cfd12442b6f7c3dbf5bbe0709", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403765, "uuid": "336b2ed7-69d6-4789-8048-56ea07b52083", "comment": "Malware payload", "value": "85db6ff84c3d0fb612adfa4c77c15cdb70e0a81eba7cc680ebd6f939f7ef6067", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403765, "uuid": "dcad62db-2a31-43ce-95ec-5e8ffa4c4ff7", "comment": "Malware payload", "value": "9cb52001901d9d9fec776f1acc62257879a52900", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403765, "uuid": "003d6a73-872e-4a46-bc5b-4f59971ab1d8", "comment": "Malware payload", "value": "a3e18500a8551c6e4382db4df0e92a427ccbe293c5096cc5e39e339b695df32d16d96216c82cf328ad07e523c0b3a0aa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403765, "uuid": "852ac419-af83-45c7-b1b3-be0250089c83", "value": "A8D53396563E9CD6FCCD12B1DE5A82EA045C8B77C292C43DA24CD02E29CB517C9F2ED1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403765, "uuid": "827f8e01-8d2c-4ca5-853c-5e67d5244926", "value": "49152:+arRBQZTsj1Q4gQG2wGTzuENlJUfMJGA8G46ma3Be3zKdg12yijb6JDXWO+stM3G:+qBQ07bwgz7NPUf5a3A3mq2yrJDXlyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403765, "uuid": "9a3cc6a0-cef3-4405-889c-e7c23848b5fd", "value": 2805612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403765, "uuid": "b8ae4511-da4b-4e0e-90c6-4a50c70468c1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403765, "uuid": "e6ef53dd-1585-4f67-b2b3-af944d0a235c", "value": "9e7d034c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5487df1b-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403652, "uuid": "1d772e7f-efde-4f9b-9d37-4ad66551f7f6", "comment": "Malware payload (Dridex)", "value": "a7f780c33215d869a077c30adfeaf644", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403652, "uuid": "b50cd90a-4712-4e8f-8f3f-0332c57b2c07", "comment": "Malware payload (Dridex)", "value": "85f6a148fcfbba439e4d75335b5c910b367ee467e94ea6c958ffd6610a970fce", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403652, "uuid": "b9e611f1-d36d-4b88-a5d1-73d23cf21684", "comment": "Malware payload (Dridex)", "value": "eec943fe33c90d48db56f7caae9d6558ee074020", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403652, "uuid": "8410bbf9-f22a-46d9-a4bd-b84dceeef635", "comment": "Malware payload (Dridex)", "value": "c8a1e71407b05719ddf6fcae60ea25bb839f7012b5a8ede550e2de081cc67b5990d84895a583fb8104aaaa1bd64781b9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403652, "uuid": "9ce21ac2-0eac-4e17-8d4b-1180606fcc04", "value": "4FF3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403652, "uuid": "935cf886-1de6-4ad3-9eec-81f69d8cb007", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403652, "uuid": "2dbef81a-7729-4222-b80e-dd98717e783b", "value": "3072:PBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjS:ZuXLcclWEc2HeSjNjGdeDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403652, "uuid": "7e048b54-0c59-40bd-a3be-1195f7980cb9", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403652, "uuid": "dbcb2f04-13a3-41d2-83d6-1ee6e43c4ddd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403652, "uuid": "703ef8d4-2b61-4b64-8269-1a40e0d31e38", "value": "a7f780c3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c4a9e6-aeee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dorv)", "timestamp": 1620362614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362614, "uuid": "665ba8e4-8e6a-4674-9662-02d01a6046a8", "comment": "Malware payload (Dorv)", "value": "5caef232625da58977ced40a8260d170", "object_relation": "md5", "Tag": [ { "name": "Dorv", "colour": "#4A343B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362614, "uuid": "26ae3324-101f-446a-a8fc-3006a3247d47", "comment": "Malware payload (Dorv)", "value": "86263727095009b136c832b851b3d9b329352d60a1ecc251d4a309d44a407c3b", "object_relation": "sha256", "Tag": [ { "name": "Dorv", "colour": "#4A343B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362614, "uuid": "9b5caea9-aa34-46cb-b3f4-629cb0ac3a07", "comment": "Malware payload (Dorv)", "value": "91a0158cc6835186bc02677f5b25659ae19c74e9", "object_relation": "sha1", "Tag": [ { "name": "Dorv", "colour": "#4A343B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362614, "uuid": "9eb08aa4-16ee-4a0f-9d03-88c49e4d412e", "comment": "Malware payload (Dorv)", "value": "859a2276e99ad0e23f3413ff3d9e5e5d00727df1b54c3399419afd42a6e6c0983d615b4f8d5be3ec297e5b803a048138", "object_relation": "sha3-384", "Tag": [ { "name": "Dorv", "colour": "#4A343B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362614, "uuid": "e41f596b-9bf9-4a97-9212-7a9ea5a8abb8", "value": "5DE22B1275E2D032E022563919F1E1E15A3F7C527A74818F3B98167E4FB27D04EB836B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362614, "uuid": "5fa763e0-c71a-49f7-a24e-15f66c2da793", "value": "9634e08ad1b3d03525c702a24b26a53d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362614, "uuid": "206f729f-3ccb-4640-ba98-4c3f4f9d6831", "value": "384:BjhSbFojJDNWdgUKaeKUcKZ9w7S+ihQmLypj56RV2LLvEDHQb0nuUTeRjzP+fXNH:BjdLUTb72hspVvTEDwAnpTeR/ANn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620362614, "uuid": "9a20bb63-1a52-4b7b-a58b-12867e0c436d", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620362614, "uuid": "feb6bd64-4343-4ed6-bfd4-79464bab2be9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362614, "uuid": "c65fec89-36cf-4022-aa18-8b0042573d13", "value": "shample_fixed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09c3039-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403807, "uuid": "43c53b5f-54a1-4175-8c8e-4d1b4babfb41", "comment": "Malware payload (Dridex)", "value": "dae27fd87c531d02b7e1858975185b2e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403807, "uuid": "ae27399f-e853-4fc2-8333-d2ff1c930382", "comment": "Malware payload (Dridex)", "value": "867448f1897966af67f856e48aef1369cbf9f8bfd8fd4c5e6bbc0b12d32237e5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403807, "uuid": "ce10cc47-2d78-46e7-a11c-d5f051720113", "comment": "Malware payload (Dridex)", "value": "a0bd8377410114d39914a6476194d28dd3cd23de", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403807, "uuid": "36d6b9cc-addb-4ddb-b8cd-043443154b3f", "comment": "Malware payload (Dridex)", "value": "827611adfb59b3b95117d82ce807f21bd36b5b2437c3a3267f80d631a683eb00d6e1355486c267e7f9532ec5da3a3f8e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403807, "uuid": "ee313df1-2912-4bc7-a699-b998a45cd8d9", "value": "3CF3D081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403807, "uuid": "d2209141-4379-4f76-8eaa-c8e3b953d51e", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403807, "uuid": "7b3568dd-1662-4586-b157-0a0e613041d6", "value": "3072:mBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHcY:euXLcclWEc2HeSjNjGde8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403807, "uuid": "27514cb2-0a2e-413c-9b6b-4c3d73a51a9a", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403807, "uuid": "bb1647df-7942-41b7-b6b3-6c967b0d3dbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403807, "uuid": "a64c983a-de85-4de5-8c3b-9558e209eb87", "value": "dae27fd8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5901c270-af5e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620410532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410532, "uuid": "80badfa2-b84f-4298-8ea9-3fff4be70549", "comment": "Malware payload (Dridex)", "value": "d86a3aa39cb3fb88481f06a1e50c43f7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410532, "uuid": "c4c479f6-83d6-4c83-bbc9-a44f11d6fc19", "comment": "Malware payload (Dridex)", "value": "869ac1b8f7f4ec2ee0b637ec584e5c85560f550cbd08b1dfe1fae011218118ce", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410532, "uuid": "24048a70-fec3-4d7c-ac50-dbd076f73862", "comment": "Malware payload (Dridex)", "value": "1cbe2b827ef061f1dffd61cce614d6d527a85e1f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410532, "uuid": "7b34c8a4-85de-4d5d-a1ba-4af1c52ead14", "comment": "Malware payload (Dridex)", "value": "f4a9d3f5e021ffd3d241bc82eb2a86058950c955842e2c75697a3a13e3c335ef466ebf8484fc5c0e4423be8a04892764", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410532, "uuid": "95cd49a1-82a3-4f73-9f6d-3888f2d3e0d7", "value": "1DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410532, "uuid": "07faaed7-7e43-4e8d-9d67-344a05d7fc57", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410532, "uuid": "f0bbdd47-7ccb-48f7-9f31-675288a3c9b0", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620410532, "uuid": "46b076e1-23e5-4b55-afa8-95bd1aa38429", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620410532, "uuid": "ec2b3e0f-a8df-423a-97e7-19f947bde61a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410532, "uuid": "ae907508-81ef-4be7-8150-8b2fd9d04789", "value": "d86a3aa3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9adbe690-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620414078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414078, "uuid": "ebe08bd0-7241-47be-a6ff-f487c28d545f", "comment": "Malware payload (Dridex)", "value": "e6f9417c788495d37e3fbbf33564a5a5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414078, "uuid": "c0dff8ca-3867-4e1e-a70a-56644b0ed661", "comment": "Malware payload (Dridex)", "value": "86d701f6a812925bd6e4d785fbf43c346a3a637a2c521d860b72d7723db91e7d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414078, "uuid": "87541688-2a80-47f2-8541-82288a4b4e0c", "comment": "Malware payload (Dridex)", "value": "a855c509c9965cfe42c57b9614553da685ec65a3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414078, "uuid": "fb7b0bf0-b29a-4882-a141-377f1c80d5b6", "comment": "Malware payload (Dridex)", "value": "d2ff80563972d4f1994c403c57c90826a6bc9b7d63a6136e42e9096e4ae8e3b9ffdcaf3a4ef4e22834fc6d67e0757d2a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414078, "uuid": "4c2be176-b153-4104-9133-89c79dc25900", "value": "D7F3C141C9C5CCE0CBE36C3A4795963B3728B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414078, "uuid": "0912453c-30c0-4888-8c22-a4cc054de0e3", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414078, "uuid": "17237d12-ccbc-4be5-a639-2c06e3c186b4", "value": "3072:5uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+ys:50czbty9uiaJljs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414078, "uuid": "7358054e-8451-405f-8753-f4eaed9f78d3", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414078, "uuid": "597f3043-8587-4cf1-bc71-ca11aae60124", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414078, "uuid": "d981d3a4-be16-43fd-b65a-3f25e95e9d3c", "value": "e6f9417c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61fb87a-aecf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620349323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349323, "uuid": "a16f9559-4cd8-49be-8b02-1d338573097f", "comment": "Malware payload (Dridex)", "value": "d28562657a9a678e3fa66e5d6e3e5dc2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349323, "uuid": "e40ffd68-f845-4dd3-9fe1-d55999106eed", "comment": "Malware payload (Dridex)", "value": "86fccd5fc1e932e79d54ab321b4b0a54e1ca9419c83d43cf75227a0747bc6e06", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349323, "uuid": "a66e09e0-8e71-4d2d-888a-49bc72f230de", "comment": "Malware payload (Dridex)", "value": "678141f2b5239ff0156be717da2d5f4ee781f3be", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349323, "uuid": "904d1cba-5ff6-48c5-85c4-4b2e67662f91", "comment": "Malware payload (Dridex)", "value": "3a5c1c7cbe66e6f859fbb5f57c179fa08bba2ad6addb4edcd1191aa27ec18f2bc7a040dc4c7f52e7e80637ec32127106", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349323, "uuid": "dd5c1614-cc07-402e-8020-ef834e83c5fa", "value": "80F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349323, "uuid": "935ab04a-2a60-4447-a55c-58c8690db1dd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349323, "uuid": "3fac9ec4-a2af-42fc-ba9d-b5beaa7c1e66", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620349323, "uuid": "02cc1f33-4f15-42a3-9a63-ed8f49e77a5f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620349323, "uuid": "fe589d3b-c327-4283-a41d-fad6aa433b40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349323, "uuid": "8c44152a-e9d2-4422-a06a-902579f2d28c", "value": "d2856265_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f34622-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407059, "uuid": "2edd9849-12a1-49ca-b386-8533aa287c59", "comment": "Malware payload (Dridex)", "value": "6d2d23ec63bb448b346d14e390108bd4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407059, "uuid": "b1ac31a7-4f16-43da-9df8-ebe7661a3160", "comment": "Malware payload (Dridex)", "value": "872314acab582e408f8d212fa09faeb33bdb34387289b1f48821f899e779b4c1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407059, "uuid": "f137bb36-9a8f-4bcc-8e84-cbe56c556c5b", "comment": "Malware payload (Dridex)", "value": "dcb6bcbc7303947d5dfb54cc83f854dcfab2e9bf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407059, "uuid": "5d276868-a6d7-4ad9-9498-8883006c7620", "comment": "Malware payload (Dridex)", "value": "21380c01c7e63403bedde51c321511d9daab2d7540c3cbb397494401d3bb1f516a20e2cf6ffa93709c1974d432f4a5e4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407059, "uuid": "598c4ed6-63de-4c7e-81a1-4923f3ea9927", "value": "B8F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407059, "uuid": "1a93db2f-a38a-42c5-b497-e8a3320fe3a3", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407059, "uuid": "a0b1eca9-b6cd-4e40-97c9-4b9e2f0e2260", "value": "3072:hBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:/uXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407059, "uuid": "cd9b3f08-e10e-4aff-a367-e205e79b1b69", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407059, "uuid": "a6a2a8ee-35d4-44a6-bac0-3c30df37f482", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407059, "uuid": "e9b926b9-4f01-4339-8653-ab5e55389fa4", "value": "6d2d23ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3f51a1-af27-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620386785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386785, "uuid": "adf99e89-9eec-4692-9aa7-0b4b0699fdb9", "comment": "Malware payload", "value": "e8f207d0d91edbd77dd5e3f31c9ce777", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386785, "uuid": "8301cb4b-4b8f-4f83-9070-94c2b7c4d7c5", "comment": "Malware payload", "value": "877411221e9ed9dd18b17ec397a04f96559a5d2c47a369033bade8a3e00fb504", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386785, "uuid": "b07bb633-80d5-4639-a9fc-1123c720f4ed", "comment": "Malware payload", "value": "b7889972ced851dd270340d214b0a7e27af2bff8", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386785, "uuid": "aff9c878-516e-420a-b9be-305a04e9d03c", "comment": "Malware payload", "value": "496d70f450ef190c7507dabd0e1d046cad27eb336c35915ceaea60a91b05e06e92f012fa5db11d59f69dd627e5329a4f", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386785, "uuid": "9df8f0e7-1150-47af-86b6-f9100e9900b6", "value": "C873AD423665A791CE7C07F1256783A097757C1EA9E1E62B1EE23ACFD8B1B010500F9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386785, "uuid": "e09ca7eb-2a6e-43c5-800c-e5a143dc47a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386785, "uuid": "68eb9f20-5a43-463a-9d96-3bafe51ab613", "value": "1536:DRA3eJG53G73mxdvdllEDsthLbl0r98eURDoq4OZZZLlCIib:DRA32GhNvLlEDsthLbl0r983RD68wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620386785, "uuid": "8a8791be-6c2d-4ec2-b13e-ff7e257e0185", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620386785, "uuid": "e38958f6-e1bc-4840-88f3-f14391d2facc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386785, "uuid": "4b3f320b-8f3f-4f72-b4db-080f9115c8cf", "value": "DDTank.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ded1b9-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404161, "uuid": "8ff1b084-457f-44db-8b83-481c419dc22b", "comment": "Malware payload (Dridex)", "value": "7df07623df22520ec1e2cde1c8b5cfa9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404161, "uuid": "4f1b5353-ee43-4ba4-b63c-25d4f5b7a4de", "comment": "Malware payload (Dridex)", "value": "87810c4496518c3436c59366e952ec0ce4d7e7fcce11d850b3336369b92e06a1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404161, "uuid": "dc620ad9-af32-4665-930b-53ce850a6929", "comment": "Malware payload (Dridex)", "value": "42a4e0d6623a5990db75b43baf1bf726515a4b34", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404161, "uuid": "5543512b-2671-44ad-9842-92d176e88d34", "comment": "Malware payload (Dridex)", "value": "155d0d7dd432f94b20df5d31ca11be10e69b249cf50ffac85a632a659c9e8acc7552190aa706a68252c711cc9557b82c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404161, "uuid": "e0cac816-3a75-4f1f-bf4d-57605659c6a7", "value": "76F3D081E78ED5E0FC075B333EA80EEF52310087691854E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404161, "uuid": "dbc72fab-b826-4176-84d6-1355161f3558", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404161, "uuid": "c56e816d-80b2-442c-ae7f-a285c48ea378", "value": "3072:1BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjr:7uXLcclWEc2HeSjNjGdeDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404161, "uuid": "a51424fa-66c0-4502-8ecd-f703eceb90bf", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404161, "uuid": "575391fb-e425-4ba8-b77d-db83c8050e90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404161, "uuid": "6f404174-df3e-414f-9f4c-ab4411fd0260", "value": "7df07623_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526d19e0-aef1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620363705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363705, "uuid": "2fabcc61-7104-4912-a38c-d69bd4360067", "comment": "Malware payload (Dridex)", "value": "620ab2af3d3b9678d5a9b1f98b3a81a5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363705, "uuid": "4ea071ba-ee43-4980-b22e-a579713ae00d", "comment": "Malware payload (Dridex)", "value": "8790071ebdcea86706210e79b0db979c75e6b96f2830bca758650b3e1e5aac89", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363705, "uuid": "30794d57-7992-4aba-b989-ad727c461584", "comment": "Malware payload (Dridex)", "value": "c5b41f75037844100cdcdd8e633aa1909e5ba7c9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363705, "uuid": "2ab8964b-442a-4807-9d30-7902f255461f", "comment": "Malware payload (Dridex)", "value": "b6e7cef53114334e5ec0f9b242b4654337299fbfcffbe94aa383b72b5675e0ebaaaab972bd0e66a551f5870ed23bc9b6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363705, "uuid": "3ea7c01d-e8b1-4a89-bcbc-630048c0c461", "value": "71F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363705, "uuid": "5d9daf11-85cb-45b2-9e52-79d623d78a4a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363705, "uuid": "7e7624ea-49a0-46c0-833e-9d7df96ed274", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620363705, "uuid": "23c74ba5-3adf-404c-9f39-1deb72b1fdb5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620363705, "uuid": "3f8158aa-bd2e-4870-8bc9-5524306d9c21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363705, "uuid": "b39e9718-b710-4fb9-8040-78754a676b06", "value": "620ab2af_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af29dafd-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620414112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414112, "uuid": "2046f1b6-39a8-4731-b60f-511d0c28d6cc", "comment": "Malware payload", "value": "f8efa196e7814a6be13e93cc7e84f076", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414112, "uuid": "2f939b20-da50-4cf5-b2ab-a7a6b29e0b67", "comment": "Malware payload", "value": "881b3bf2ad844c09238f8afe8083ca7fa9eb499035032007885b24c82a0e98ae", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414112, "uuid": "b9f90638-efbd-4279-bf04-88beb0e01012", "comment": "Malware payload", "value": "463ee67645286f5240321212602fcb699b4bcffb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414112, "uuid": "44cb92bb-eeb2-4bb0-b67f-c2bd4e0b0f6e", "comment": "Malware payload", "value": "dcbb4b95354898c92f6be519b90696fc63219b2005c41aa607753f0da3304663b12aab5181ac02a9ce1ce005c5b6fab4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414112, "uuid": "fd54c289-e163-4f3f-b5db-e9f951866c25", "value": "88F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414112, "uuid": "014a8c59-a51d-42c0-a29d-213b3ab8bcce", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414112, "uuid": "a6c54c52-126f-4e39-a195-8bcab6fbb69e", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414112, "uuid": "5f06baa6-a7ba-4856-acbf-5f33622b91ed", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414112, "uuid": "6685bc08-c48e-4dd6-a230-2578b2e32ad4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414112, "uuid": "855219ef-961f-4731-8c2b-f15431e5bf24", "value": "f8efa196_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a564f98c-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404217, "uuid": "dd09ed6c-78bd-4c15-a5c2-9eafeaab548f", "comment": "Malware payload (Dridex)", "value": "ed99fd62bb5189e1b934f11ea219caa3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404217, "uuid": "a1b45ce4-ce80-4e4e-be1a-336ba4529ab4", "comment": "Malware payload (Dridex)", "value": "88829aa31196efc9c2b981cbb44da56791400972767fe622ae3245f05805125e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404217, "uuid": "b90dc269-fec3-40ca-91b5-f4c0f52875f0", "comment": "Malware payload (Dridex)", "value": "61c8cd829243786edd06c3718a99cfc9a6b11896", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404217, "uuid": "af1f7e51-e43b-433b-b0d6-da7cfc55cdc0", "comment": "Malware payload (Dridex)", "value": "8126598629fd37898637c516cbfb740f371a0727113d5cb49269121f448bf67230ae4dc7c448421f2ab3502701afcabe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404217, "uuid": "ff51d55d-cc85-4ad2-874e-5eb47ca59c68", "value": "FCF3E081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404217, "uuid": "322da101-b4af-42c4-9096-f23ee3092fdb", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404217, "uuid": "fab88372-c675-4708-9fda-df5fe0b90a8e", "value": "3072:QBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHAh:kuXLcclWEc2HeSjNjGdegh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404217, "uuid": "b53afc76-63bd-4cf4-afae-37a061e18510", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404217, "uuid": "401d2d92-1f8f-48f0-8012-d2a364b14f62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404217, "uuid": "86eef0f0-05aa-4606-a48c-517ead1333d8", "value": "ed99fd62_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a19102a-af1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620381703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381703, "uuid": "613d0c50-5352-4289-ae97-644d86e5dc2d", "comment": "Malware payload (AgentTesla)", "value": "5ef4af2a8716cf835575f950cd98934f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381703, "uuid": "db40b1f3-7d31-4e09-bc5b-25b4ef5eba4c", "comment": "Malware payload (AgentTesla)", "value": "889aa4e4126bf87e42b319cbcfee809c05508d1de3e6c3cffdaec3f458f5b2ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381703, "uuid": "084efe01-460e-4efc-9a1a-83bb0913468d", "comment": "Malware payload (AgentTesla)", "value": "33ef9667e4b099cb9c385e10dfd4fbdb3124da2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381703, "uuid": "0076bc8f-1f57-4261-a32d-c761a5719aac", "comment": "Malware payload (AgentTesla)", "value": "73436217328e3ac585e7a2ca5a4fe338583209809c57e6e4811d6d7f0d5029a37cec9800c849ad396f3d6270389668d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381703, "uuid": "2cb11e91-d41d-47ae-9c20-70b471c5cef2", "value": "B655F1A92350CE6BC6691176C09127F001F2AC41F251DE8BBDD57CED7AF2BE147A8283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381703, "uuid": "686c33fc-8515-4d85-ac61-a8cdfe33865a", "value": "12288:4tYLWiR2CrlRl5bkzRBULRuX17HkGUM91e0EG6t36Qai5rtTaMp:4tMRXlj5bkjULoX17HsM91lRQaKt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381703, "uuid": "7dbae775-cb9e-4d0b-a350-b4780aeb1e65", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381703, "uuid": "e0764271-5499-44f9-af6a-b7d12a5b9bf9", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381703, "uuid": "880254e6-985d-4050-8cba-932abf487c42", "value": "5ef4af2a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186eded6-af6f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620417725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417725, "uuid": "635c072a-b97e-40f2-9e16-8cb305020afc", "comment": "Malware payload", "value": "03ed7ce5412f34c682b962f78ac3ef21", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417725, "uuid": "9826cf2f-820f-459a-b0c2-a0c43f35bb04", "comment": "Malware payload", "value": "88cf278cc7d89b143c3d84f1a333dca7a43947411715d253e06cb087ae1ca4a1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417725, "uuid": "a2e509e0-eef5-48e4-ae7f-a563bfbe1575", "comment": "Malware payload", "value": "0d2546379533fa15b9d285e0a50711481328e191", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417725, "uuid": "70aaa81b-6052-4c6f-acdd-e073bc5c6790", "comment": "Malware payload", "value": "8f859935e9ccfa4e027775e117e0595909087dbfd878a4576926e824c98bb96423ffdc239cfbe2a398fe52f3532dcaf6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417725, "uuid": "1deb9731-dcee-4ce4-994b-13cedc416cb0", "value": "73A42398E35512B19479FE753EEF308C52C68E3B140C76A7768693878C075A39E1EFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417725, "uuid": "e6d57752-941d-496b-a141-1546d788f62a", "value": "12288:Hj6F1VM/PyLUKTgFEEq+msjo95zTvTMUQ6w:Hjg1IQUKTgF/T0HTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620417725, "uuid": "0ad2288b-f71c-4f90-a032-662a5705cc23", "value": 463973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620417725, "uuid": "3a559366-ce53-432a-b6a2-3d9a8359c25e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417725, "uuid": "1cdfe6ed-3422-4693-8841-c60ebe0192f2", "value": "03ed7ce5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c35090-aec7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620345677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345677, "uuid": "f7ef0ffe-abbd-4789-8698-f57b88335974", "comment": "Malware payload (Dridex)", "value": "8140b8a281fc60912791e764e420b7ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345677, "uuid": "14c6d9dd-aef8-41dc-9cb9-784cdb80fe8c", "comment": "Malware payload (Dridex)", "value": "88e9f32ecfb02694be10b1e6c0a94adeff8207fbe5dc7d38e00013108060dc93", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345677, "uuid": "cb539fde-4365-45fd-be74-60790ac8699d", "comment": "Malware payload (Dridex)", "value": "85396fa3fba0be664c9fa8005a5f93268f8f0bd0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345677, "uuid": "c1dbba9e-638c-4f2c-aba9-64e2f97de0d9", "comment": "Malware payload (Dridex)", "value": "1c82838ec3aa1b23e5103f5f81acf49260d597d70f9e4152e2852c70f6943e3f268d9e882eafa9a7d658f7b203143057", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345677, "uuid": "9d08973b-8bd4-428c-83a4-e8cfa02b7e20", "value": "FBF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345677, "uuid": "c4a7cf1d-971c-49fd-ac26-ea3d6a9d3a57", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345677, "uuid": "d13dd985-62c5-40f0-bde8-3d42febcd646", "value": "3072:2iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:teAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620345677, "uuid": "94044b2b-9ed0-4806-890c-8888ae705d2c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620345677, "uuid": "1216ee05-da1b-4ef7-8b41-1ff98dde420a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345677, "uuid": "04f57a3c-ebb3-4601-9a5b-49949fd2f04a", "value": "8140b8a2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2644ee-aef2-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620364257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364257, "uuid": "20efa01d-ec65-43bb-a731-e039e1b432c1", "comment": "Malware payload (ArkeiStealer)", "value": "63952adb00431b660831b14e9237a168", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364257, "uuid": "706ed6a3-a1ba-48fb-a478-e9f3d57d4b99", "comment": "Malware payload (ArkeiStealer)", "value": "88fad3262ad6a29dd59a2611e65bd0e4c746083bb22e64b9627373db2249f1aa", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364257, "uuid": "60cffaf8-0cf6-48cb-9f14-c80f51a4fb65", "comment": "Malware payload (ArkeiStealer)", "value": "95b70e5a2b19221715d69a3e7ab532459bef0b03", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364257, "uuid": "855375bc-5852-4ed4-aac8-301807b86b5b", "comment": "Malware payload (ArkeiStealer)", "value": "039491223ef6751d8fac24059d9b32c5105d5ad8e226b6da7109786653a93b881a339fed0faa25f246f4f9f80ebd7dad", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364257, "uuid": "e8716b5d-e37c-451f-8461-659f7c3c86aa", "value": "D4D4E030A690C035E4FF16F489B992BC65287EE16B2451CF62F43AEE52387E5AC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364257, "uuid": "e015f8ad-09a9-407e-a82c-f5ab2a1a6685", "value": "3859d82b882d7140b7db7bb274c90a75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364257, "uuid": "732da20e-4c60-47f3-8fb2-7f2a65cfa58a", "value": "12288:nLV6c5fVKdyW/Khfssjd+x9kez4DB9y+KN247O3XSgTAJJqbdmf8n4:L75fFhf7jd+LcB+N247iiwAJJqZmf8n4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364257, "uuid": "fe88ce6b-d4b2-4bb9-831e-7b0efc3e19ee", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364257, "uuid": "06e41340-bd51-424c-b23f-48faff060324", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364257, "uuid": "5e598212-ecc8-4f3b-93f0-569c0cdb3c3f", "value": "63952adb00431b660831b14e9237a168.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e366c7e-af86-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620427613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620427613, "uuid": "665b95fb-bae3-4196-bb1d-b44103d5767a", "comment": "Malware payload", "value": "e75bc08cc8d01858203922798e274aae", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620427613, "uuid": "a08d3a3d-8e22-4209-ab31-a503bf8886a5", "comment": "Malware payload", "value": "8906b9ddd4d91aa4090b8895777a3f771a01ca4600228c2deb366b7c25a0ee21", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620427613, "uuid": "88d96c07-c70c-4b75-b080-8e7fe269dcbe", "comment": "Malware payload", "value": "a25f6bdcb8b7b36c3d621e07b75f82091676b7ac", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620427613, "uuid": "26968857-6c89-4c5e-9160-d21b0738f1ce", "comment": "Malware payload", "value": "cb9fbcd09158060f2e65ce91efa1832184d8fc23d69b127fc922ab1001f0ca9eac2cd02cf2ce1bf497cd604ad6b00642", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620427613, "uuid": "4ef759b1-a624-43f9-bbae-115653871dc7", "value": "0FA44A7748890A04E25D3B74C190F77C83166D952BE9AECFAD867D8A92396F0F410DCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620427613, "uuid": "517abddc-0906-432e-b290-c1d1ce02d4ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620427613, "uuid": "6559366b-f651-43b8-8203-ca01548df371", "value": "6144:H57IEATjjHIwPbm+Cqdr2FwuakGN7LzCgS7wap6S2KUnwVhx+CS:H1IEAr3P2FukS7XCguwaMHgJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620427613, "uuid": "946c8e09-53df-4758-b05a-c1021ff5a990", "value": 473400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620427613, "uuid": "0c70236d-aaa5-4b63-915b-be0ac7144eec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620427613, "uuid": "f7a73948-e82c-408e-8a3f-ca64f65d6e9c", "value": "SecuriteInfo.com.Trojan.GenericKD.46260253.18072.23926", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64811aa-af43-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620399199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399199, "uuid": "869bc3a2-538b-4c5e-a8cc-e5c3e9a922b9", "comment": "Malware payload", "value": "a8bb4472c2229a000b0a50aec60b307e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399199, "uuid": "81fecd58-13b3-417b-a754-85b9c1129701", "comment": "Malware payload", "value": "89430cdca33183e7453b9b445be744b158f121fb9c074a2b30325d8668862fe9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399199, "uuid": "ae788a1e-e177-4e89-a9f8-642c3b3db4ff", "comment": "Malware payload", "value": "d686149a4a5ecfd1c13493ce740fe0e4d33ca46c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620399199, "uuid": "e05fa1c0-fdb3-4a70-9e60-baa18734d644", "comment": "Malware payload", "value": "3f899332496906427a9a75b7bfe53bead6169ff47c5bc2224d22ee24dc6160df98fa7026623b9ac08631eef8ab659852", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399199, "uuid": "d3d61220-4810-463d-a492-1dc733376c61", "value": "19712F332FB3D971D7280B3B41AB5AE73659A360474940CD0F9A646D2C159DBE53C712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399199, "uuid": "21cb75ba-de46-4972-9cb8-ea5d091bf665", "value": "13ae18cd70fe91312dd8206f2d86742f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399199, "uuid": "04368063-8832-465e-9b63-1fd9c5ba8237", "value": "24:eFGScwQtH18Uyn2XgupDW+YgbPjVa7c4QjzRXlkUla52XI5Ctn0y0:iSb8UhwulW+YgUc4IRe8K2YUyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620399199, "uuid": "7591a740-bcd5-4070-a703-5d5abcd9ee15", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620399199, "uuid": "adc751e6-6e7b-4967-9f91-78fe4276fe7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620399199, "uuid": "aabe5d24-3b28-4802-bd57-24f3d88dab67", "value": "SecuriteInfo.com.Variant.Jaik.45760.4001.18794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc18618-af36-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620393309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393309, "uuid": "098b2bf1-fe70-4f75-914e-c7a9086776ca", "comment": "Malware payload (Mirai)", "value": "0b24a7d3be3e960808fc4d5d0d914f91", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393309, "uuid": "a587c997-ae15-4572-9186-0f30ae3ab5e4", "comment": "Malware payload (Mirai)", "value": "8977df602a43db8ff252cfe440d2fef41ff85eec5cf57169e107d13b99639fc2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393309, "uuid": "f93f8e02-7517-4882-bdc1-d9eddb2e3bc8", "comment": "Malware payload (Mirai)", "value": "f874617741621ecba231b99327aeb539b19ee4d1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393309, "uuid": "54579534-bd31-463e-a503-d3828866a35b", "comment": "Malware payload (Mirai)", "value": "7c0e21daf0129987b16dd82e7fe0c690abcc9937c6211a3a2a0d59e59dca085831087cb9627b6a3774635b6ad5fb4a0a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393309, "uuid": "b21288d4-f716-41f7-a938-e362612bb510", "value": "92B39DDBF74B5651C86187F40BCB4BED3E2323119F67C9E7AD0E2A3949781CA4A06391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393309, "uuid": "12e5049c-93f6-41d7-bcba-b7f3fe7637be", "value": "1536:h1naGG0UiUCqYrdwRvyznj3wK48q3Waavgg/LWG:hFaGG0SCluByznU98q3Waavggq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393309, "uuid": "52d74d27-583f-4337-98e6-2fb144d220b2", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393309, "uuid": "290d4886-9e32-4c8e-8056-060e15c02d04", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393309, "uuid": "e32d9107-c971-44f6-a6a8-a49b7dd5f182", "value": "badpackets.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfe7a14-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404014, "uuid": "d028f1c1-a6be-4297-84ba-38c475b48491", "comment": "Malware payload (Dridex)", "value": "950cf70a42016396e1edb3f3458eb0c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404014, "uuid": "44ab7205-d91d-4175-a1fc-8010d15eef47", "comment": "Malware payload (Dridex)", "value": "899d9b6c6b8ef50c125b0e734998cd2d7d4ae4189807035636dcffd0451f0a20", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404014, "uuid": "2e98dad3-716b-4a6e-930d-4a7795e35b18", "comment": "Malware payload (Dridex)", "value": "08164edcd6c50666ba2952ee9395ed21306de768", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404014, "uuid": "d9811bc8-d85f-4ef9-a3a7-c4f075fb2c76", "comment": "Malware payload (Dridex)", "value": "6042de6212e8e9413d70100a4a87f532afb278babab8f78a1c7c5df8b54b9b07ea5687b4e75664684cb22a6191e66f8d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404014, "uuid": "9e835f2a-c25f-47ba-898a-5ca293a878a1", "value": "40F3D081E7CED5E0FC179B323EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404014, "uuid": "afeff02b-5d42-4368-b71d-5cfc469af733", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404014, "uuid": "e77820ba-0dfb-4fd5-b2f5-6c8bc0cb2e93", "value": "3072:RBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHaH:PuXLcclWEc2HeSjNjGde6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404014, "uuid": "817ab806-da58-4f58-96c5-8bace03ce196", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404014, "uuid": "b6c61498-19a1-4452-9275-833f67b975fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404014, "uuid": "3e8c313f-bf65-4a77-b01c-2cb131ad4b21", "value": "950cf70a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5219148e-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403648, "uuid": "7f0874f0-0380-4162-aacd-53b71528651a", "comment": "Malware payload (Dridex)", "value": "27b1e388b3bf63225ad7db4dc279a5c3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403648, "uuid": "568d27f1-7de8-4f49-9be2-9239d544fe33", "comment": "Malware payload (Dridex)", "value": "89ac3afa1b5a730c47531a7c9c79094316964eed8c3774198f92b7941dcc3032", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403648, "uuid": "72722e95-6184-4254-a97f-6a31a20dbc77", "comment": "Malware payload (Dridex)", "value": "85163199e437fea8fdcab49c3758bedc49cb7ebe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403648, "uuid": "8e138c74-fb7a-497d-8b3c-e15fa86deb8a", "comment": "Malware payload (Dridex)", "value": "8f7014e6e8538ff354901bf83ec13607215fb6c254d80631721be1f1c976fdb62619f436f7ca1bc8ef8cff0013d0d30d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403648, "uuid": "425a91d1-4a2f-4bb1-b4ae-9bac2965a31e", "value": "56F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403648, "uuid": "5a6757e6-8a9b-4872-bbcf-a590f57cfbdb", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403648, "uuid": "9554f461-de99-4e76-abff-440eb6e82550", "value": "3072:qBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHqE:auXLcclWEc2HeSjNjGdeKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403648, "uuid": "8b7c014b-88b2-4653-bb2a-35c385776ace", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403648, "uuid": "ba74d918-bd02-4480-8662-174c5f7ed6c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403648, "uuid": "7b54dacc-3330-4122-9459-f48b5e9822ee", "value": "27b1e388_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5259a7-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407128, "uuid": "f5bae2f6-02da-4983-bbd3-a8d6ad9d6020", "comment": "Malware payload (Dridex)", "value": "8a7e96a27a93a70d54d0937ab49865f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407128, "uuid": "22e18083-de14-469a-b745-e6c5dfabbe6f", "comment": "Malware payload (Dridex)", "value": "89d30f7b596d7dce820bb85e6df1bbdf231e9dbbb5eb73ea932d15cff8867ee2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407128, "uuid": "b2a96f8f-73cd-4a20-8735-c842a2d3a2ab", "comment": "Malware payload (Dridex)", "value": "ca6cef64d32bb8a8d116ed943962d54b64356043", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407128, "uuid": "89270fed-73d9-4063-8b6c-c724717fcc76", "comment": "Malware payload (Dridex)", "value": "bf55ae52efec9c8f21a0abf5ee3ec66801340d042a386b8181b0fb53a1edb05a18c149e11334c8c17961667f94873f0c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407128, "uuid": "c12248cf-03aa-4124-87b2-ce28801124d7", "value": "52F3D081E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E051A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407128, "uuid": "e2349210-b7bb-49fb-8571-243d52c7c4c1", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407128, "uuid": "899d0a42-6fa0-4ed9-9247-42d024bff4bd", "value": "3072:1BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHRX:7uXLcclWEc2HeSjNjGdexX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407128, "uuid": "81a15021-de8a-49fa-98ec-5f359d86e007", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407128, "uuid": "bd99e482-532b-4205-a262-a1c1cb031705", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407128, "uuid": "a5905c62-56c3-4226-afe4-11b960e999f4", "value": "8a7e96a2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b936e50-af2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620389571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389571, "uuid": "31af2788-e5c9-4628-b5ef-182eaadc1b6d", "comment": "Malware payload (AgentTesla)", "value": "880ecdf9fddbebddd3baf6d944a605bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389571, "uuid": "92dfd96c-c98b-4449-a567-fdfc409f5150", "comment": "Malware payload (AgentTesla)", "value": "8a2f8f90b4b7f278e331ef302bf80433c74cb61b12ff5076560acc09aa11e8cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389571, "uuid": "007cf58b-2a51-42a7-8b9a-f76ee9311802", "comment": "Malware payload (AgentTesla)", "value": "650e05c896f4f5a1f0b15b474f480f556094a796", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620389571, "uuid": "abe71116-f4ca-4636-a426-1dfc10a37ca2", "comment": "Malware payload (AgentTesla)", "value": "0c69c4d08ee702383f9e9c140e3483d747aba82b65e0751e98dfd49e36a9acfb68979c6af1960a4bd5c3e1661646fde4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389571, "uuid": "731fcdde-5d6e-4bbe-ab29-9b1ab1f6186c", "value": "7D05E0222345DB61D8294B78D46123F027E2BE51F712DE0BEDE47C9E7872ED146A26C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389571, "uuid": "5f87249e-5786-469a-b8b0-da0f91c67595", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389571, "uuid": "2b6535a7-4dc2-4f25-a806-97fc59d644cf", "value": "12288:7TGiFpG+/etFvh+zdk6BU1nbqZh3h0KFbfr+1Eavl3PzGZR2k3UHhM:7Civejhqk0U1bqZhXK1Ll3PzGbB4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620389571, "uuid": "86a1d442-3cb1-49f4-a5f2-40f0bfe673af", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620389571, "uuid": "b675116f-a197-4a78-a1c7-fae733c6e823", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620389571, "uuid": "c79f2107-0013-44db-a8dd-c2d977adec17", "value": "880ecdf9fddbebddd3baf6d944a605bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c226094b-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392240, "uuid": "b6026ece-23ff-4309-9d46-0d7eba793650", "comment": "Malware payload", "value": "fa23c320de4bced469a65985b81ee9ad", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392240, "uuid": "20df4700-d5df-4c24-9a5f-02c94b9da9f9", "comment": "Malware payload", "value": "8a3f17ba6222c70be596979cb6b67ab07e02df41d62662dae870d52fd7df2ee3", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392240, "uuid": "f89f2aae-3239-41c2-bd0f-0101f42bbd70", "comment": "Malware payload", "value": "e1b07d2e1613a24789f2e5660e6a9f21d4ce57af", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392240, "uuid": "4c8054df-ecf0-4f96-8701-982e4f0883a4", "comment": "Malware payload", "value": "caab0976cb7a86a3d4e7c2f0047f1337eadde2033197cee2ee0613d694f048ba157bdc6e76799e99ff25716860d85a7f", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392240, "uuid": "bb5d036f-81ff-498d-98e0-a12620073207", "value": "10A1E850112C1AB17346597AD26FFA52B50EC81B097B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392240, "uuid": "1b45274b-6ed1-4efd-885a-1f24bf22a67b", "value": "96:lRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:lRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392240, "uuid": "d34626f3-a536-40fe-a8a7-00702e6727af", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392240, "uuid": "c14f2216-6ece-4f02-8dda-39bf0a4c85e7", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392240, "uuid": "4a240b55-4525-4d66-b17a-7d34b01b636a", "value": "8a3f17ba6222c70be596979cb6b67ab07e02df41d62662dae870d52fd7df2ee3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac27f8c3-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620414107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414107, "uuid": "691fad55-dcae-4205-a9e9-c52ac2cd5549", "comment": "Malware payload (Dridex)", "value": "e66b01338768d45a8e08602c3aeaf1e7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414107, "uuid": "b2b8ae19-f3b4-49a3-9fb7-fb5f070a4c7f", "comment": "Malware payload (Dridex)", "value": "8a3f4402c336d10f21e5d987e0436be2d0c1c789ca2dde6e43083038b575d97b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414107, "uuid": "8c94a1b8-b5b4-4b81-ae6e-6267f37f5aef", "comment": "Malware payload (Dridex)", "value": "4ecf4e10701e8f768077bf43bf2c8ebd447f7aad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414107, "uuid": "26b0bcfa-3492-4fed-a1b1-5c9bc6ec83a9", "comment": "Malware payload (Dridex)", "value": "8a47daa4a6b86440e229b9441a5f5a320741ce02da0f8f4908c5234838b922fd8b7c7b9d2bc8c8d4a7fc6e7c3070d7e7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414107, "uuid": "88cf04f0-4048-4dd9-884d-936aea1b8924", "value": "32F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414107, "uuid": "af7e2772-b890-42fa-b194-fca02192c28c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414107, "uuid": "f509b91a-59d0-470a-9b74-2f024411d2b9", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414107, "uuid": "74e68f69-1bb4-4d22-afb5-37e2d5c5de29", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414107, "uuid": "9f4f3ef9-a1e9-4fd6-9205-41a895feb9f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414107, "uuid": "381df585-2e49-437c-8557-3aaeba310012", "value": "e66b0133_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1aeaf2-af0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620374518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374518, "uuid": "59b2646e-de19-4c49-8977-5a252d1a5c34", "comment": "Malware payload (Dridex)", "value": "01ec22a389ad68de26e4d4ff2981cf01", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374518, "uuid": "80ad8223-7bbc-46ab-9b7a-ee03e04ec9d4", "comment": "Malware payload (Dridex)", "value": "8a619105075522cd6ca2adba7da93946193e40259ede4d67bca6c47a02689655", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374518, "uuid": "69658c60-a1a7-4019-90d4-f2033e7ae8e1", "comment": "Malware payload (Dridex)", "value": "89d9c8ac1eecad9ac0e09af46020789fa837aae0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374518, "uuid": "6d2cb2ba-1697-4d52-a9fd-c4fbfc61514e", "comment": "Malware payload (Dridex)", "value": "11a1fab178a65d092cd95ce4ecd5d6cd3faf82184786d92c845a144db848d0af6360f6f3717c6db511746aa945d2d96f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374518, "uuid": "e7885dd7-9524-4024-88fd-63e4e709b9c0", "value": "C6F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374518, "uuid": "b09bf5ef-96b8-4fb2-953f-5a71154c2307", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374518, "uuid": "1d4863f7-a2e7-4dd0-9676-0bf32ffee4e8", "value": "3072:qe45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:n4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374518, "uuid": "6965e01c-0f33-41aa-ac60-87694d82b0f8", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374518, "uuid": "12325081-ca01-4cf5-a5bc-4b2cf7a4ba30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374518, "uuid": "fdc4f740-1e16-4f03-be07-a18ab30f08d3", "value": "01ec22a3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8210d67e-af72-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620419190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620419190, "uuid": "de3970d5-5fe2-4b4a-a4d0-3bd57ba89dba", "comment": "Malware payload (njrat)", "value": "27643633696fa248a0b4c71e49615434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620419190, "uuid": "a5037bc2-85e1-40b9-93b9-04d05862ec5a", "comment": "Malware payload (njrat)", "value": "8a6cb8e4c30304c28e48f7b231566f6cb6b0003f333ad391182d9e60ad822f81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620419190, "uuid": "b4b35a7a-ee85-4d7a-b582-38f9d7d3731b", "comment": "Malware payload (njrat)", "value": "649381492b07b574498b09fb8660594c01051860", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620419190, "uuid": "61f1b793-5fc5-45a5-9b95-d52e0a954497", "comment": "Malware payload (njrat)", "value": "77830cfd98d59a5a81e27afc6691a5f6031f6bad1f3b6ff561af1ea9a3748cec03a8612be47281e943a5ae59ea444c8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620419190, "uuid": "8653ff3f-1c36-4d14-9bc0-8805c30192e3", "value": "A8E22AADFBF64466D2BC0AB50571950003B4E103E523F77E4ECA24E62B6B6D84B84DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620419190, "uuid": "f0739a51-fc55-4144-b033-f57e47a9bf21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620419190, "uuid": "07392d64-d57f-4e56-8375-3b2014007333", "value": "768:LPwoqkZlH/azx1+ta+q3U97v8+QmIDUu0tilKSj:u4qSp7QVkwFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620419190, "uuid": "dfa0dcc6-bfd4-4b38-a64f-fb941419c2d0", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620419190, "uuid": "4f1a9c49-f3b2-4510-bfc0-ac3401b61299", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620419190, "uuid": "7044f0db-a4a5-4b68-b0ae-f5aa899ec2b4", "value": "27643633696fa248a0b4c71e49615434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94fc49d-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403472, "uuid": "736eb529-b653-47c8-9a6f-8b47f42d312c", "comment": "Malware payload (Dridex)", "value": "2a51d3e699316ec68442fb2c1af6b654", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403472, "uuid": "e50312fc-e814-4eeb-8078-1e6a5707ce21", "comment": "Malware payload (Dridex)", "value": "8a8d2645accf9d9c44417760d3b3e8b01461e44a967622b121bf82b2d95f840a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403472, "uuid": "add9f58e-e70f-431b-8d24-b9f9e41076b4", "comment": "Malware payload (Dridex)", "value": "7620d7511b517aa3ac9f30c76ac7ae0e3bb92941", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403472, "uuid": "e8933bfa-c47e-46e9-bba9-bd412c400711", "comment": "Malware payload (Dridex)", "value": "8b91f1117d59c699ca700001a435e9f22b69dbf9c907872633327442c121ca9e58b64def1c713697f33393155f3b7cea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403472, "uuid": "1e32be78-69c6-4089-aec1-18d5db25f651", "value": "BEF3D081E78ED5E0FC075B333E680EEF52310087691854E4EF29DABD96BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403472, "uuid": "5ed6e57f-f7cb-44a9-91d3-d037978bc910", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403472, "uuid": "0cc37cec-8e1e-49bd-8a9f-64b209888fef", "value": "3072:6BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHdC:KuXLcclWEc2HeSjNjGde9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403472, "uuid": "7080d540-0e6e-4ded-b206-71c79081419f", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403472, "uuid": "56f10b42-5be7-4425-86a9-23039de08ab0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403472, "uuid": "7a0aacbd-5850-4b6f-9e14-e26729c7a818", "value": "2a51d3e6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df765d54-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403456, "uuid": "f6f9e3cf-27c9-4924-8a4b-b7566d9061e9", "comment": "Malware payload (Dridex)", "value": "469511361a2fc7cf0345661d9ae61f59", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403456, "uuid": "ae648d53-cf50-46de-87ce-894d5da3e94e", "comment": "Malware payload (Dridex)", "value": "8a9ac36eb839e3021be18825892d1d247da599be68e42f00a69505f829e587c5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403456, "uuid": "0458341f-ad3a-4a99-af0d-fabe851d342a", "comment": "Malware payload (Dridex)", "value": "13856c25b74843439387d0b57c8f2eb08a0c9b2d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403456, "uuid": "aa6fbd73-8738-4ae7-a9cd-51edd82fa068", "comment": "Malware payload (Dridex)", "value": "61654cc767f99b6d50bdf9b85439d6b3a353b0f6d1e4484b2b8edfa9ba06e249f0e77aeac85a3d9c9c26a5d233b6d5ab", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403456, "uuid": "55cf42e9-c1b0-4af6-953b-f593103167b8", "value": "C4F3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403456, "uuid": "ad0a6abc-aad4-47b8-bbc1-0cbf8e518f94", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403456, "uuid": "05c063fc-b163-41a9-bf29-668dbefdf4bf", "value": "3072:jBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHSa:1uXLcclWEc2HeSjNjGdeya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403456, "uuid": "ad4337eb-b81f-4835-abff-7b1dc93550bd", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403456, "uuid": "6e7d5b96-ede9-44fb-811a-a752ad278a17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403456, "uuid": "11b2d4e8-0e12-448c-80a6-2dbc5b278bd7", "value": "46951136_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5675732-aef3-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620364784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364784, "uuid": "8eb6caf0-37bb-4d44-bd35-68b7590fbc65", "comment": "Malware payload (SnakeKeylogger)", "value": "de715e43aa24c4c42d5440600974d4f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364784, "uuid": "6ec2b9e0-b2fb-4d56-a766-e98ca4e658d7", "comment": "Malware payload (SnakeKeylogger)", "value": "8ae3921d1c658a95aa61e85467ef617393cb58b77d22930196e0366e79b6ef64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364784, "uuid": "619c4627-e0a2-4816-91e6-0d00f8bfaeaf", "comment": "Malware payload (SnakeKeylogger)", "value": "ffd5b35c547bcbfda4096d2ef7ee119291911bbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364784, "uuid": "c4722b10-3c4f-47ff-a6cc-940a07d47990", "comment": "Malware payload (SnakeKeylogger)", "value": "05e640d976c3dcaa97e3dcc5c61adb8e87855b0ea0c5d09ed4afd6b797d67b4a0eb1ae45bf0f1437f693dd097579fc9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364784, "uuid": "53534fce-9f0e-4dbd-8f30-7b0d530a02f0", "value": "FF05F0522381CB51DA7987B8E06013F027F2BD52F361DE1BADD47CAE7876ED10299683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364784, "uuid": "2afcf5e6-0383-41bc-8c6e-1d5a6409f319", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364784, "uuid": "604058cc-c7f3-437a-9807-b5eca86a9cff", "value": "12288:NvDNTtmX4mGPhwTJo0XMV/uEUdyVvaZHUj5rHI+C/Z6ZNYfm41fcJjiM:NxQImGPGNnXMmEUOaBUrCQZCfmmf2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364784, "uuid": "9463a92e-3ba8-47bf-91d8-27b6960704ca", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364784, "uuid": "b52232ac-5194-4d21-b14d-0a2d43a4a8cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364784, "uuid": "a4209563-31ba-441a-8a87-91d23d4e7881", "value": "vVDRVCHudBWzrDU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2650ec-aef3-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner)", "timestamp": 1620364609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364609, "uuid": "a1862c24-137f-4aa7-a3cd-2157f4643afb", "comment": "Malware payload (CoinMiner)", "value": "e65f3463068c583ba9ec1aabc08d1cd5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364609, "uuid": "079fd1fa-b5d6-4690-aae3-39cd6a5117db", "comment": "Malware payload (CoinMiner)", "value": "8af4a9ab3943a49bda13ba1af87ea3a5934efb29b3f0de9284744a155cab0f0f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364609, "uuid": "b203ef19-e157-4d46-bb8f-2e02211a34d9", "comment": "Malware payload (CoinMiner)", "value": "97eca180a490fbf6fdbbb96eee1769d315594ad7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364609, "uuid": "c17def24-3a34-4207-959a-fec504582047", "comment": "Malware payload (CoinMiner)", "value": "2c2499f5b93e80e181baed7b23e57b2a2c69f8bb0a16e3e0f998216751c01a7078af4ce228bce8378824cad76b823730", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364609, "uuid": "1e23b0a5-3bdd-4ab3-924f-df966f660b37", "value": "F1E2D195E2FE2845D2B90B3DDD536A092421EC1A669587AF1FC0312FFD237343C78624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364609, "uuid": "0d3a4649-c18b-439f-9833-4669db56b047", "value": "3d2b95b998469ac775106242f347c0e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364609, "uuid": "bdf2c245-3bc9-4377-9fc9-e0476700e677", "value": "768:iw/iOWTK3JWhOM/qZh7UJGcZ/tshwWNnbcuyD7Urs9:RQK52fqZSIAlshwynouy8rs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364609, "uuid": "10d551e7-90ad-4abb-9b28-a33dbcb310b8", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364609, "uuid": "8f68b5dd-6c9e-4a77-8f2a-e2ec7f626efe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364609, "uuid": "6f73d1a1-f02a-42c0-acfc-3c48d9d6d85d", "value": "x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ffdab6-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620414090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414090, "uuid": "f231b607-1fa0-419e-9567-e119a16c87e3", "comment": "Malware payload (Dridex)", "value": "2213d2a473b54e30d9023b7536921dc2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414090, "uuid": "c24edca5-e895-4d2d-bc8f-d2d67dca2009", "comment": "Malware payload (Dridex)", "value": "8b015b3845e6fabd7c3d9b92c8493cf064d1533f7fb3cebbf8ec2c2a03dcd1fa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414090, "uuid": "01e9be95-96ff-4094-94d4-9874fa2c29e5", "comment": "Malware payload (Dridex)", "value": "9e02745e2aa5bc0e3226e9507f9c27e5993b5007", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414090, "uuid": "627d8d5b-883a-4640-9043-c23583933195", "comment": "Malware payload (Dridex)", "value": "0f462c2d27dd75d83465563c0824bfa95a8335dca0817c2b840dafcc9efea0eb7f9943bff5606a38628a649548ef3acd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414090, "uuid": "7fb880f6-4da1-4e79-92f2-1e3905f89303", "value": "96F3C141C9C5CCE0CBE36C3A4795963B3728B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414090, "uuid": "4fe4a9ee-3cf9-4075-8991-d9f982286681", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414090, "uuid": "b1a127c8-aa52-497f-b5da-21ba71f0ed82", "value": "3072:BuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+ys:B0czbty9uiaJljs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414090, "uuid": "714dba35-1655-47b8-b9c1-829172a183f6", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414090, "uuid": "cca3141b-b919-4a7e-93f1-138151c7efaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414090, "uuid": "ca7291d1-197d-4459-947f-cc7bafb5dfe4", "value": "2213d2a4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf714d84-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620392664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392664, "uuid": "82b35e7f-5beb-49bd-9961-46e210139a38", "comment": "Malware payload (Dridex)", "value": "49d14084d4d783ef727669c54a0fca8d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392664, "uuid": "baf9dc63-b531-4062-8a15-be1c8bef7463", "comment": "Malware payload (Dridex)", "value": "8b6874010a51fb0a3ffd1b5a9658cd876a1722f332447ade906e8d9f63edf892", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392664, "uuid": "22e5d892-ce68-4e16-ac2b-832804fb4e96", "comment": "Malware payload (Dridex)", "value": "d5c9268588aafcfd285eda07dff31709f987d114", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392664, "uuid": "9596aa58-1cff-409d-89f5-f99f98851b66", "comment": "Malware payload (Dridex)", "value": "5f79b354163a15e148687049d25c9481cd9cdee4e592fd1e4fbcd851b859596b35b24152fefde54b79e457cc01ea7666", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392664, "uuid": "bcf9990d-bd4d-4eff-a978-c5ad0c9fab67", "value": "05F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392664, "uuid": "33d5e57b-59d5-450c-8c2e-ade8ebb592c1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392664, "uuid": "cee147c2-10e9-4613-9e75-32178959835e", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392664, "uuid": "667f2a3e-dac3-4934-89af-3f19fbecb5dc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392664, "uuid": "fc2b1ca7-0c80-44b4-b419-a21e0dedddae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392664, "uuid": "9e040594-8cb7-4bc6-b70b-53778c14c93c", "value": "49d14084_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6fc6236-aecf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620349298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349298, "uuid": "3d204746-1b81-4c93-8286-b13aadb88186", "comment": "Malware payload (Dridex)", "value": "dc3d858e06067de7fb27da3915714516", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349298, "uuid": "8e5654f3-ecd9-4244-ba4f-fd0874ed44c1", "comment": "Malware payload (Dridex)", "value": "8bb14751e0646d0c0b43146d02d7e7b3e66651dce1610d783e3b84f739bf4496", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349298, "uuid": "89abb244-922f-4ba8-a1aa-ab9976095e87", "comment": "Malware payload (Dridex)", "value": "c9609d8a7ca9315e4e7659fc859ffe114a7c82cc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620349298, "uuid": "723334df-cbd4-40f4-874a-e2575b76f608", "comment": "Malware payload (Dridex)", "value": "9371d0257561dc9f49377e8ee457d33816a904af8d905c9379e25f09be1ac53115558cbbaa0c5e883f43a1a653d583c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349298, "uuid": "f556de45-5c9f-4031-908b-b095a5a317c7", "value": "F0F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349298, "uuid": "5a0c8c3b-fb4a-4e71-b4c1-621d46fabaec", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349298, "uuid": "e5f89570-d0da-4cbf-a8e0-dc0fc5b0c82c", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620349298, "uuid": "3e84898f-6abd-4a8e-b840-039a71234a41", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620349298, "uuid": "75e52a3d-1544-4d0b-b6f1-cc2ea646d7c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620349298, "uuid": "23799c2d-cb9c-4c04-a443-1bb96ecfeea7", "value": "dc3d858e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59358de-aeee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620362691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362691, "uuid": "42c36132-d92e-4b25-aced-71090549f244", "comment": "Malware payload (Formbook)", "value": "0690de55a2a4081dd2ebc1f658bba4da", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362691, "uuid": "e69e670b-a973-4c0b-96f8-bf06505da14a", "comment": "Malware payload (Formbook)", "value": "8bb3e6cace7598576464639d7f88d0c4d55919b2e110a341df89a1569ae0d5b7", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362691, "uuid": "fa62dc7f-1b45-4a22-ade8-75688b13b0b1", "comment": "Malware payload (Formbook)", "value": "e4952f3e5cb0c877c682678dbee181a8c737df28", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620362691, "uuid": "e3afe61a-9890-4542-8a5c-507f50c7fc1c", "comment": "Malware payload (Formbook)", "value": "9620b3640fc1a6167f7e1a76b90e13d24b36bb3132ba49e74cd996cd998460bf0b6f2ecf592d2c6fa53d0f44533279a0", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362691, "uuid": "52f01493-c93a-4e89-90d5-abee188efc12", "value": "A8F423C325A82570D779DB351436418C83B5B017930ECE2C7E6D0AED5EEB2629B227DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362691, "uuid": "77468b96-88c7-40e6-a3e5-887c702d7bd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362691, "uuid": "1dc1c293-6f98-4797-8aa6-0c88dcd06df4", "value": "12288:zhMEtD2n/eLfBT09UJM41Af1ffAQ8Tk+CvIqCIDexEvPVuf9eQUzeBUa3w9EswhA:zhU6yKJM41AfVd8RCwqvD/lu8QVBp3UR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620362691, "uuid": "6f27d042-86d3-4355-b57e-5d7e03ba4046", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620362691, "uuid": "6ec35f1d-59eb-4426-9a11-5d7c9203347f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620362691, "uuid": "d7c85dfb-4db6-4b55-a119-4c018bfd2e64", "value": "akon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3769bfd-af61-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620411945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620411945, "uuid": "c017781f-2894-4230-affc-dda41b1c1c52", "comment": "Malware payload (ArkeiStealer)", "value": "b08cec0ea39c7ec2b6ae29b4ed8dd74f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620411945, "uuid": "01fb1b6d-050f-49ff-9f40-6785fd42b22d", "comment": "Malware payload (ArkeiStealer)", "value": "8bc5ef0b7e7ba588ec0b035903a19c8cac3a70c46ddb52a8d5f49a94738797ad", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620411945, "uuid": "9be8bf5f-6909-410d-9985-7c2f6b63fe20", "comment": "Malware payload (ArkeiStealer)", "value": "ec3e53bb08b4368f15935c68da625e0fecd7a041", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620411945, "uuid": "444df3d1-a8b8-4399-b636-c4fc8b2613ba", "comment": "Malware payload (ArkeiStealer)", "value": "3f1ae0df110b62f9a360de199c3195606c9d1add3b037628c3bd5e3f12f1986f9e21368398282bf55c9a9fbdbabab5e1", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620411945, "uuid": "d7400113-6cbb-4729-bfec-5080de002fcc", "value": "FFE4E030BA51C036F5F712F84DBEB37D652D7E612B2040CB53D4AAEE66246E4AC3125B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620411945, "uuid": "ac34c726-5b7e-455d-af42-b284d26d6e10", "value": "063255465708c5d561d9303ddc23f4f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620411945, "uuid": "959ca484-78c4-44ad-b5cb-5748c673ab47", "value": "12288:OKUucM/9p1cWa/XJpULekkKOBNRDKhU0HDy6t6wp8b:5t/qf3xbMDyLbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620411945, "uuid": "761a7382-1ab7-4d6a-bcf6-7679ed5df91a", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620411945, "uuid": "73b83383-e5c3-4b97-b0e0-fb5c131a4075", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620411945, "uuid": "ba059b0f-6c4b-4f07-8c47-d8a736e220e4", "value": "b08cec0ea39c7ec2b6ae29b4ed8dd74f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe73ba2-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407376, "uuid": "c8961f9d-bb97-40ab-a025-2c79cecebdfd", "comment": "Malware payload (Dridex)", "value": "67fb2ca64fff7767421905aed047fb1a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407376, "uuid": "40d9993e-1c5b-429e-81f3-4814f48420a2", "comment": "Malware payload (Dridex)", "value": "8beebc30d296df5a0449eca3e65c329d0baefe81dfbe996b1642953837e68122", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407376, "uuid": "0fdd03d3-ce27-4b4d-b74b-6cbb9a238efd", "comment": "Malware payload (Dridex)", "value": "497cf6a706759dee9b76bb2a9c5fd21ae3ce6496", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407376, "uuid": "017046a2-52e3-4309-845b-94a9ecfe4b3c", "comment": "Malware payload (Dridex)", "value": "0a8329891f903272eeb3d9efa1a97495d8660007c0b523ad97ce5a8ce6bf2cfe5cc504754ad82066b405c61d02ab5b35", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407376, "uuid": "cfda11e1-f5ef-4ce6-8889-3c362cda7036", "value": "FFF3D080E78ED5E0FC075B333E680EEF52310087691954E4EF29DABDD5BB7E15164614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407376, "uuid": "a6e52c61-642b-4f9b-93a5-421f31fc0e14", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407376, "uuid": "6553c897-d52d-4c8d-b988-1439a0ed0720", "value": "3072:SBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHj8:yuXLcclWEc2HeSjNjGdeD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407376, "uuid": "56a4c9d9-2892-4611-af45-0c14b8b3ec57", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407376, "uuid": "4c95f168-bca0-4168-86cd-fdddf17fad18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407376, "uuid": "b076209c-2c49-44b8-878d-a7ffec730703", "value": "67fb2ca6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7567c3b5-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403707, "uuid": "349682eb-08e4-46f1-a6f1-1bb0b9b44467", "comment": "Malware payload (Dridex)", "value": "8af76c221ed9ef4d18e64c6132de2310", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403707, "uuid": "7f1c753e-03d9-4a97-b8c2-07cd22404478", "comment": "Malware payload (Dridex)", "value": "8c46cf51ba13524014dbbf9fd900239e97cd841affb0812985fc1ccedae9e2d5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403707, "uuid": "d15adc62-1c38-4056-9989-f85e323bfae9", "comment": "Malware payload (Dridex)", "value": "30b2b54f190983e7d3821efa626490d94f9c4ba7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403707, "uuid": "395671ae-e00c-41e8-89a2-e42eaf79c456", "comment": "Malware payload (Dridex)", "value": "9b69515365c98bf082eed3254f4226b0eb251234bb309645b54bbf9b6698ac3f7e4b5a1621d428df9023ccb095e7b082", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403707, "uuid": "bce35a06-57a5-4912-989d-82bb61937397", "value": "3BF3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403707, "uuid": "9293305f-3e7f-4968-9a56-753467ef89a8", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403707, "uuid": "0045299a-eb6e-4b2a-afdf-e45e9cd4dc01", "value": "3072:JBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHuB:XuXLcclWEc2HeSjNjGdeOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403707, "uuid": "deee069d-b060-4f12-82a7-4a24353686a5", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403707, "uuid": "74c90b50-92ef-4e35-89bb-5f041b4e3754", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403707, "uuid": "07dec742-fd8d-49e4-b305-3c792732e1b9", "value": "8af76c22_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a255f5-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620392573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392573, "uuid": "6f8e8dd9-b8cb-4458-b7dc-be114d90cb1c", "comment": "Malware payload (Dridex)", "value": "8e93ca78baebd5db670b7e5ad3d3648c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392573, "uuid": "081e9849-80b5-4cc9-9d0f-885d2bd51e90", "comment": "Malware payload (Dridex)", "value": "8c552735b9cc1eeb850efd9b49ac3736dd585c06109353b70aa86a527ae01ab1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392573, "uuid": "df3012f6-cc4f-4eca-8636-9500d0369de3", "comment": "Malware payload (Dridex)", "value": "901a8d4443d0d7e9eb7c1e76b1b9dd34f9a23e11", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392573, "uuid": "991e73cc-3e04-404c-8f6c-56d819080024", "comment": "Malware payload (Dridex)", "value": "2977b6accc75712d3f00ade0bc55507a45ade9037e35d3413584fbf5c9e0a171a2c3d21cecbf04de23f439c044051095", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392573, "uuid": "be36f649-812b-432f-b5c5-3beb44652435", "value": "7DF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392573, "uuid": "9548f632-b2e1-4893-806b-049cde3da998", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392573, "uuid": "99aeea17-dd91-447c-8cb9-0ba5ffc7123f", "value": "3072:3e45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:O4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392573, "uuid": "f086a9dd-0645-4740-8459-2a7a19d0e93e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392573, "uuid": "65aa3226-715a-4eca-8813-4f2ce64586e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392573, "uuid": "9d8998de-b2ed-4e3e-b6f7-5bce29455084", "value": "8e93ca78_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be7a9a1-af5e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620410563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410563, "uuid": "b4d30191-7efd-4503-99a8-aa1c62d35833", "comment": "Malware payload (Dridex)", "value": "9a196fac38b263559e42930a372635eb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410563, "uuid": "f9a943c0-eea4-413d-a8f6-95c0f636bfc2", "comment": "Malware payload (Dridex)", "value": "8c6ade79f252f599755a54036bf4621bdcd95baf13ec1956d323143e8403ad23", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410563, "uuid": "a62b677d-ea36-4c95-bf24-8f9ef2362fb1", "comment": "Malware payload (Dridex)", "value": "1fd26e66c50011ee676d3ad1eb28fc0214b66f0e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620410563, "uuid": "e8ef205b-3ff9-4c3c-8228-a492087b71ad", "comment": "Malware payload (Dridex)", "value": "5458a04731fd235ecc35c2a7703d778bcd15432d55ace95cb7fcaa4b0b20fb1b4a64e8a5dd8dd015a4370c6c2eb9c83c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410563, "uuid": "650771a9-7bc4-4bed-920c-92546a7d0d94", "value": "36F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410563, "uuid": "9e515bd9-37e5-4661-8cac-59bf383d306c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410563, "uuid": "44db2c0a-2931-4cd8-9a36-f213a5a07f27", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620410563, "uuid": "34c710f6-37a9-4ae0-9a01-3b1503c6bb06", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620410563, "uuid": "2404297a-717d-4030-aa72-cb77f93b311a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620410563, "uuid": "1ad1a554-6be8-4b73-a411-24ca0d276613", "value": "9a196fac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2feec353-aed8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620352910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352910, "uuid": "0d3f8dff-f2af-4482-b650-678d130851eb", "comment": "Malware payload (Dridex)", "value": "795631dfcc42d96852cfbcf1333f8d4e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352910, "uuid": "d20c4c9a-61ec-4515-b903-3c1b7c492ad3", "comment": "Malware payload (Dridex)", "value": "8ca46b2dc391a26dc0900599cb05214cbf6564b063d3edd974478feda3a671ad", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352910, "uuid": "53fa49df-1b08-4a0e-b257-f1b75f7e6360", "comment": "Malware payload (Dridex)", "value": "b646d2fe82f55d5cf6118e43dffc7c6afc00288d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352910, "uuid": "9cb4483d-42a9-4872-8fef-ea841387249c", "comment": "Malware payload (Dridex)", "value": "f415303257eb06f5b5c56bde4efec7ddabed870a173b052d87e753b255086e445b3aaf151f11e064d2563657b6a72701", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352910, "uuid": "978fc97f-93aa-47e4-b6b9-05a46c9fea34", "value": "89F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352910, "uuid": "8e6795d2-fb79-461d-b4cf-3f4680e43d29", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352910, "uuid": "cc783c24-2460-4a85-a592-5036a21dc92a", "value": "3072:3e45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:O4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620352910, "uuid": "7801e9c1-ad32-41c6-9320-5e3d21445220", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620352910, "uuid": "31ddd00a-d08b-469a-96b6-28ee5762edd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352910, "uuid": "be08fbdc-4d20-40f7-8fd9-f07ccfaba122", "value": "795631df_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac0109e-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407421, "uuid": "2e4de300-5dc3-49c6-813d-a5226aa73797", "comment": "Malware payload (Dridex)", "value": "ffda4cf9f55a3115a754da42a1ad5606", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407421, "uuid": "4739bbba-9043-45fb-bd15-fb8de18bfa08", "comment": "Malware payload (Dridex)", "value": "8d3a5f8ea94a768b7492f232a923cf9fa5371b55d078cc9e09efd2210d647de1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407421, "uuid": "95a3fa5b-28ec-4efb-9cab-85f550a31742", "comment": "Malware payload (Dridex)", "value": "5d5d56f09ed78db005bd80e1d078cc91fb34f373", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407421, "uuid": "e2d99a66-cd8d-4220-8116-1ad0a7935522", "comment": "Malware payload (Dridex)", "value": "e9550d1d982e0abd98ac81d6fb31a1e410721301b42d9cca87927bc96375b00455f243d49b5cf7a1c12125df319d5d40", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407421, "uuid": "7ceb6abc-1625-4cce-bb50-e5e7a39eb1f5", "value": "41F3D081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407421, "uuid": "787d6644-0ce8-4856-abc9-d70ce551f615", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407421, "uuid": "2039d82a-3109-498a-8493-dc400cbda00f", "value": "3072:OBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHNz:2uXLcclWEc2HeSjNjGdetz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407421, "uuid": "1825e4ef-6c12-4cbf-a4d9-40f94614279b", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407421, "uuid": "924be4a9-067b-476c-8162-62d5f941d4eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407421, "uuid": "6e2803aa-44a7-40fe-bba0-9e130882fa18", "value": "ffda4cf9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6732476-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407306, "uuid": "709388c8-7cb4-45af-8954-2beb9930e09d", "comment": "Malware payload (Dridex)", "value": "24aa6ff43353bb0f2e24e2984635564e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407306, "uuid": "5dc2a168-a79d-4b93-b262-768f76ff0b1a", "comment": "Malware payload (Dridex)", "value": "8d5ef84a2af2873a1fa5d309b3e82fe1cdd4027f6078c78f381f9f080877d224", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407306, "uuid": "8b9064b7-ecf0-4908-8ee7-2ebee58f6afa", "comment": "Malware payload (Dridex)", "value": "006a0424f118f78e83b42b7f92ae47a6cc469e26", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407306, "uuid": "592010c3-2c8f-4da6-b4e8-abeaeb3c0cea", "comment": "Malware payload (Dridex)", "value": "47e499921816ba280f32e4a089d55bf849feb95efa2f704947ba0c79cb8b792cd0d23b71e30f8c05c1d32ca9ed18a158", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407306, "uuid": "59dd0c77-4bc8-40f9-af51-fee5066ba79b", "value": "8CF3D081E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E051A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407306, "uuid": "1f810679-7e2a-4c62-8ef9-6a92842a5e08", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407306, "uuid": "94c9b108-c6ac-4406-8b6d-5898dbad5adf", "value": "3072:PBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHji:ZuXLcclWEc2HeSjNjGdeDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407306, "uuid": "af045ee7-edd3-4622-b892-427d42915477", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407306, "uuid": "2c2e9034-9567-4ebd-b34c-186db05f1cc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407306, "uuid": "0ced58b3-64fe-4c75-8db5-ad0078ba15b0", "value": "24aa6ff4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea086ecc-aee8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620360094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360094, "uuid": "5ae35274-a84b-4e35-ad66-b027cef518f8", "comment": "Malware payload (Dridex)", "value": "cebdbb7a45616201be8cb51e04ec2524", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360094, "uuid": "1a799a94-d011-48b8-82d6-91e97ae19163", "comment": "Malware payload (Dridex)", "value": "8dc03db3945df2b4351c4f916d345f6754461f47b096abb69d71d0ea13d48dbf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360094, "uuid": "7f6c3852-b36e-4be2-b7c1-fac5ae67c53c", "comment": "Malware payload (Dridex)", "value": "307ba810d4b1fb44d60e56a8a148b9307d93477f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360094, "uuid": "cb4a2f5d-ef3c-4144-83ef-76433291fed6", "comment": "Malware payload (Dridex)", "value": "edc303a177f757ad0f66af0cef57ae44cba825599434b5d5a707de5f5d9d7bf877c71cc2dad553e65bcbc17ce00bfe2d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360094, "uuid": "eb42644f-ff96-4ec7-98b1-74b85d5769d5", "value": "1FF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360094, "uuid": "317f9839-18a5-4482-90ed-d6eba5ae2e64", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360094, "uuid": "a73c62a2-e2ba-47e3-8392-c4eb0194b071", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620360094, "uuid": "37f50444-994f-4bb6-a508-e29b4a7733ee", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620360094, "uuid": "9f51dda4-2a8f-4698-8f30-8f8ce177fdc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360094, "uuid": "68e04086-e234-4809-bbf2-b332a2f555f1", "value": "cebdbb7a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207ac92c-af27-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620386814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386814, "uuid": "d42dfa13-7ca5-4326-8649-1a91a7ca42b0", "comment": "Malware payload", "value": "d259a1c0c84bbeefb84d11146bd0ebe5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386814, "uuid": "05bf9255-f8b3-423c-8a12-9b81864da33f", "comment": "Malware payload", "value": "8de12184a006d3340241492baca0ba1034182b08d3c6a0f09c0af99d539bd48b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386814, "uuid": "cd860ee1-b084-41f3-b598-eed0c17b2b68", "comment": "Malware payload", "value": "feaceced744a743145af4709c0fccf08ed0130a0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620386814, "uuid": "17f2ccc3-d79a-4b3a-b7eb-a3075ae03751", "comment": "Malware payload", "value": "ae64369c020129ea0cf9d5a187bb094c4216f7c98ed4154721901617745d94b3484f55dba9029407253ccaaa5def1f26", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386814, "uuid": "10de0dd0-4540-4592-bce4-1509ac21f306", "value": "5F53D14A33D57598D0A827318CA34BA11F717D11CE438FA3A6A0B77EAC7539D7C01DA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386814, "uuid": "0260258f-a64a-4572-97bd-9e1039a619ec", "value": "2e8e9d7482c7c6b5198e024e4a2e9f34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386814, "uuid": "41882641-a12c-4d45-9ce1-47a2cd263e34", "value": "1536:Tp/w1frpj7bA+W9jtQtqiheYsMaRBFqWfDP:i1jR6FiUpsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620386814, "uuid": "a1fcfeb8-ca22-4ea0-95d0-fd271bc9f65a", "value": 65261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620386814, "uuid": "06c82a35-eaac-4305-ae36-c92ed209d1b4", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620386814, "uuid": "8c12777b-ff0e-4f3e-bbf2-ef680a049378", "value": "hack1226.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8ebc36-af66-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620414086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414086, "uuid": "6184e876-8b4e-4ffe-a74b-5568f1369583", "comment": "Malware payload", "value": "d7d3ec77978ad2a8af03820b5810b947", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414086, "uuid": "0edc560f-0c88-43eb-bb79-d34be8c701d7", "comment": "Malware payload", "value": "8e43fe1f2f5781e9d5c85851df9d465a8a056e8d69418ce9fb97885ab260116c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414086, "uuid": "b4546200-0bf8-4bd7-bfda-deb345107fbd", "comment": "Malware payload", "value": "da96d51b427106c0d1b7dcabb35e0793ce0b9d7a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620414086, "uuid": "63727246-5c4d-4746-b49d-3c77776af2be", "comment": "Malware payload", "value": "3c3393f30eebd650956d59e95abdcf9606aaec604c892d342f78a2019b3d10e3fc66a3f0c547b8ebc140be695b6f356b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414086, "uuid": "cb8591ff-1975-4775-b43e-1086b2fae5a1", "value": "57F3C141C9C5CCE0CBF36C3A4695963B3728B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414086, "uuid": "7abea25f-8c71-4ba4-bfdc-051fc2edaa3e", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414086, "uuid": "f2a34e0d-c31e-48c1-9b32-4b257b2bb97e", "value": "3072:muFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+d5:m0czbty9uiaJlU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620414086, "uuid": "2bcc9937-9d61-432d-babe-527bd7a90c41", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620414086, "uuid": "c5a259a6-68da-43ed-99b2-e91669cb9b6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620414086, "uuid": "ecabddbf-b80a-4af8-a194-1fc9974f2b70", "value": "d7d3ec77_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ded27af-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403748, "uuid": "04d1aec8-609e-4a19-9b11-0a9b4e799fcd", "comment": "Malware payload (Dridex)", "value": "16f4e12b0394b8f2b4d4cd28e1e0d538", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403748, "uuid": "c6ae3de6-6af9-4e79-bb1c-b9c88f2f8e99", "comment": "Malware payload (Dridex)", "value": "8e6e20fef1ebaeacee3b99417ce062d0b8787722fc854e23a6154a3b9e477f1e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403748, "uuid": "e3073a02-fb87-469d-a5b2-27e4a962366f", "comment": "Malware payload (Dridex)", "value": "fa80ba6e881586035245e41b060b381a2c6f93e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403748, "uuid": "45584503-beed-4eaa-ab5f-28a11c7c0fb5", "comment": "Malware payload (Dridex)", "value": "bd431a7c9c5a48044f6ef0bf6eec866eecf644c0c120f7a36b3e9ff76d3cabd22e75f5d05398155fd3e1286758a742e7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403748, "uuid": "d76d7457-4a3a-475d-a332-277263bf3b1a", "value": "B7F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABD96BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403748, "uuid": "e5eccdff-8318-42a4-934c-3a78a1bcc63d", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403748, "uuid": "902273f9-d35e-4951-bd6d-3422189d1bc5", "value": "3072:dBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHit:TuXLcclWEc2HeSjNjGdeCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403748, "uuid": "6b0fdb35-d505-4e72-a9d1-80e43a8eb9eb", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403748, "uuid": "7d621a2d-9b66-4b79-9a39-ad075e8db874", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403748, "uuid": "8a34b83c-3511-4b49-ba8f-a0249f74f6d7", "value": "16f4e12b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf8502c-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404280, "uuid": "1cd2897b-ffc4-4619-a920-c2f381d577c9", "comment": "Malware payload (Dridex)", "value": "573fd60361ad36a69d92f24241751787", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404280, "uuid": "f40ecfbc-1cdc-454c-9b0b-3cf67e06ccdb", "comment": "Malware payload (Dridex)", "value": "8e742e790869e6fe2800fdbeca8b98c25e0e4a56b0d29d2d727cd0a5d61b037f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404280, "uuid": "7e82f05c-dbe9-46bb-9989-a98edd984f0b", "comment": "Malware payload (Dridex)", "value": "c5c7df3f64a310ce5993342ea319ec9b4e0aa026", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404280, "uuid": "51ad6d39-0f07-460f-b5b9-1ee7dffb91d0", "comment": "Malware payload (Dridex)", "value": "b657327c0538e1f0ce3658c2678fed889713a0f00aebf82ea9a5d7ad7d82229a5353cc71716c8dc06bb3946bd6b31a23", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404280, "uuid": "f7f9d8e9-6fcf-4839-9241-a1b1761178cc", "value": "60F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404280, "uuid": "dcb6a090-ee53-4e32-968d-fac5216cd906", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404280, "uuid": "1f0edef1-2674-45e0-808b-fcd1de052194", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404280, "uuid": "0341b262-cdf9-4e3c-9d9a-9f46d7be7922", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404280, "uuid": "86ad058f-a086-4aa2-aa25-2b30fe37caa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404280, "uuid": "bea3263a-db10-402a-a775-9f9b67ba1085", "value": "573fd603_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfa4e57-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620385252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385252, "uuid": "554ef44d-c25b-4801-aec9-fb0fd86c4b83", "comment": "Malware payload (Dridex)", "value": "bf1721df2a5bb8e00f1bb460e5a5afaf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385252, "uuid": "71bafd65-8e2a-4262-95ff-cc666fd3ed72", "comment": "Malware payload (Dridex)", "value": "8e7de2017d5b9cd2d92d8a772de6ff0197b0588af45a8ca2195746142e2cd843", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385252, "uuid": "5a397f94-af09-4e06-9640-e8365064bc36", "comment": "Malware payload (Dridex)", "value": "9e011ebf16eb3692458af2221b56a4d366136cd7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385252, "uuid": "6138af4c-bccf-4b7b-ac12-66436d5adfb7", "comment": "Malware payload (Dridex)", "value": "85b5e6128482df69ac0c7625275fb910f70d63d98ed6cbd118ad50c18cad681a2bef7579393c20f7402bf5b8c6a62642", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385252, "uuid": "e6267eec-924c-408c-9418-e04c47fe455c", "value": "1CF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385252, "uuid": "a2db6574-56ff-4971-8257-84d2bfdba558", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385252, "uuid": "1f6162dc-15d6-4e13-af5f-0cb0e875d4c9", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385252, "uuid": "9f385401-5f57-4abb-beff-165715e79b93", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385252, "uuid": "a9b96fc1-e7e8-4431-88a3-8eb97c985e79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385252, "uuid": "cde6811d-2ca0-464c-a604-e561b1ae5c9c", "value": "bf1721df_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc77dcb-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620392553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392553, "uuid": "61b5e087-3fdd-424d-8e6f-3e0b2cff2795", "comment": "Malware payload (Dridex)", "value": "9afd241b784d383d212e78018a586ddc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392553, "uuid": "80369ffb-9d61-43e0-9b6d-9396815ce025", "comment": "Malware payload (Dridex)", "value": "8ea04ca3e672c82441c9645dea0d797d7654ffb7d346b51ea2ab4032efd6b60a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392553, "uuid": "7f4dba5a-9718-4fd1-961a-61ddf99f7596", "comment": "Malware payload (Dridex)", "value": "56bf283f5799aa661a43f6e93ae61bd67a8e1765", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392553, "uuid": "03bb0fa5-5ca5-42f8-8418-fdf8f0119f02", "comment": "Malware payload (Dridex)", "value": "98ffade96b1ec710c1235787001249dbf8999ef8ea9ebeb36920efe4f4c4bfa904365058f3065ebe388c51a57a298e81", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392553, "uuid": "75b557f0-2dce-4f36-8a59-226248348749", "value": "ACF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392553, "uuid": "46f613d6-fcc8-4e59-a2d3-14f3f3b40256", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392553, "uuid": "29015366-dbb8-496e-8e45-966d834a99ec", "value": "3072:2IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392553, "uuid": "06a852ef-0134-411a-a04d-4eeb7ea5e8c6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392553, "uuid": "aa4ed127-e035-458b-8678-6713e876efc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392553, "uuid": "f1a6e801-9a6f-4216-9d5a-af21e6abc439", "value": "9afd241b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158ec4e0-aed8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620352866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352866, "uuid": "414373fb-c98c-4f4f-a644-06ff0b78c4ac", "comment": "Malware payload (AgentTesla)", "value": "391ca69674fc2567f094a62af5fb9496", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352866, "uuid": "4c335b48-d2f4-48d5-86dd-cd39b9e3ec6d", "comment": "Malware payload (AgentTesla)", "value": "8fa5172f19f08577bd48be27c7ca107ffca65581ed595509a17bef3cfe9f236a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352866, "uuid": "3d01bf29-2dfc-41af-aa4c-3b377b616fb3", "comment": "Malware payload (AgentTesla)", "value": "cdf7a69c5583bedaf4085fb7f69997ecd5f34240", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352866, "uuid": "03adc26e-3db8-49bf-b90c-87532f4eb0e3", "comment": "Malware payload (AgentTesla)", "value": "652d541b639f879b148b3267634d4a4c66ea78328707700bd0fc613efa4dae9913ec99f8abf0ba4fe0050319b229c9ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352866, "uuid": "5d9b17d4-583b-48ca-bb45-54a702ec9fb9", "value": "0655B1A83100E0EEC6178832D7CADCF596102D75562B950793233FBBBA3ED57AE34496", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352866, "uuid": "e5e6d524-fc26-48f6-bfa5-0b49195456d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352866, "uuid": "55c54630-6d00-4592-87df-3ac6706366e1", "value": "12288:YzU0oLLoS60/K7yh0VvKo8957c1zk33165ob4b2SUUIfLJd/h9EYel4gJVk0XrT6:D0oLAF85EI3385VERzjGvJb+miOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620352866, "uuid": "e950cc95-0b12-42b5-b389-f3609bed9202", "value": 1314304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620352866, "uuid": "1970a0b6-9e1f-4a01-a7c5-32b24c5f21a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352866, "uuid": "a2bf7343-a208-4b4c-9bf1-ccbf2f574656", "value": "SecuriteInfo.com.Trojan.GenericKD.46251898.3849.19641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99006ef4-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404196, "uuid": "0ab20279-18c6-4a6c-9d3f-f5781a480655", "comment": "Malware payload (Dridex)", "value": "87d0fa14ceaeacf6f19fd6b4e16c22d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404196, "uuid": "655903f0-990e-4bf4-8a33-f617b8758ea7", "comment": "Malware payload (Dridex)", "value": "8fab907449db6943079c3e455ac0c751dc7407a63261fbe5f53262101321e1ef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404196, "uuid": "70624cf7-8365-482e-8b55-05bd73b7eb2b", "comment": "Malware payload (Dridex)", "value": "a3e776452e5f8cc0ef0aad2298ff2965c8a3b382", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404196, "uuid": "f8592129-501a-41d1-9e72-ce46eeeecdbd", "comment": "Malware payload (Dridex)", "value": "3ee7bc820726d61d83de51a79fdb664da68d4691d264573a19d8d4a81d338c96cdf064e0a7c40a4d9778111016cae52a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404196, "uuid": "fa7c2e78-cc4d-4d6d-9c74-09674b70e8c5", "value": "5CF3E081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404196, "uuid": "3374c1f0-f3b8-41ea-b040-f13e1aa71d13", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404196, "uuid": "24749458-5676-4416-907b-908dcea88b10", "value": "3072:NBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHAh:juXLcclWEc2HeSjNjGdegh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404196, "uuid": "8eb070cf-078f-4903-a4cd-bc6c0f8a2924", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404196, "uuid": "20daa161-7f55-4bfe-bb61-07d441e4fd6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404196, "uuid": "0f688e51-6940-494d-bb73-aa0e4748296e", "value": "87d0fa14_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86940e77-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407172, "uuid": "231a8efc-78a9-4e42-b375-19a666ea067b", "comment": "Malware payload (Dridex)", "value": "f43965c59219adf14c1e3299d2256532", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407172, "uuid": "49cc96ea-696b-4c21-815a-2ef3ed5ed0c8", "comment": "Malware payload (Dridex)", "value": "8fcd5d0a41b24cc9001b6a2ede7b474003a71b30f597f83f5774ac5604f073f9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407172, "uuid": "365ad14c-8411-4b6c-94ff-b5c08dfda005", "comment": "Malware payload (Dridex)", "value": "cb9997a3b5907e08a8c18bf9efc3d059ba312e86", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407172, "uuid": "7da3baf6-a909-40be-9233-17706cfafd2a", "comment": "Malware payload (Dridex)", "value": "c14a207112987929c49e2ce732060d571ebc1709350dabc50401a960521f0a8051799bb0bf019229adb38a013f826a39", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407172, "uuid": "75e8e62f-36cb-4023-a4c7-88c8ed5b34e2", "value": "A3F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABD96BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407172, "uuid": "964b9e74-e676-4003-9fe9-ab86ba4b3164", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407172, "uuid": "85b677ae-2add-4cf9-a154-1fc9320f5fc8", "value": "3072:rBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHit:NuXLcclWEc2HeSjNjGdeCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407172, "uuid": "0c3beb0f-6fef-4b5c-83e2-817889b73a32", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407172, "uuid": "b2d03391-e11d-41ac-a2c9-4a77b7cd7355", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407172, "uuid": "c1962b47-d532-441d-aeac-b581a47abf71", "value": "f43965c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0621bd-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403774, "uuid": "7267ab1d-0eec-43ef-b582-1426c87b02fe", "comment": "Malware payload (Dridex)", "value": "6ed7fb93b9b08e6786e8b6339d682400", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403774, "uuid": "a634dbc7-91be-476f-87b7-f77a6769dbc8", "comment": "Malware payload (Dridex)", "value": "9023b7eae74aebca48f7861fd3d9f971b584d4ebc8ae14219fc7bac2721f2d98", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403774, "uuid": "04fdc592-cdd3-4465-9813-f3f69dbcbfa5", "comment": "Malware payload (Dridex)", "value": "796374e348b5d0f5abb100f114a37f71f81716e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403774, "uuid": "d238fe22-867e-4f6c-acd9-e6a35ac6f2bf", "comment": "Malware payload (Dridex)", "value": "0381b6f8b8a56d2cb1cd060d2085a2065c5da1c885041e0a5526e7c9d7444f01f1eb123b806f55eea33143f1603fb73c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403774, "uuid": "82b3d320-a0f5-47fd-ad2b-e388a37968b3", "value": "54F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403774, "uuid": "b3bf789f-003d-42c0-b018-341194faba40", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403774, "uuid": "c70966ef-ec76-4a97-88ba-0c2dc179d7ec", "value": "3072:tIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403774, "uuid": "f904d4da-e9de-4366-b4d4-3baa3c21919b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403774, "uuid": "b5a7bd9f-f4af-4c7f-90eb-d75dab8157b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403774, "uuid": "dfecf477-8e35-4669-b10f-86ada6482d12", "value": "6ed7fb93_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523d531f-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407084, "uuid": "2f09ad7d-a67e-45f3-abca-1d42e2b67eb7", "comment": "Malware payload (Dridex)", "value": "cfa7eecbf9cd5f4593318ff9fefae231", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407084, "uuid": "f9da80f8-6300-4950-8aab-307ab5ee9219", "comment": "Malware payload (Dridex)", "value": "90abff0a244b94b69712f862e5ebd8036e8a1ffdc074791551fbf1715ba1c964", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407084, "uuid": "944b4425-bfba-47e1-bc30-3dac7a942da0", "comment": "Malware payload (Dridex)", "value": "40c89eeabf81798b8e3eb5d2e30df3256d5e75b5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407084, "uuid": "f5d5c2f1-0f9d-47d4-b2a5-91bb2d3bb9bc", "comment": "Malware payload (Dridex)", "value": "b854fb6574945caa944968930031442f75c88f6ef171dc4a06d2554f67ca14dd9410ddeefd2762a81549aecf168a06ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407084, "uuid": "9b3ac7a0-c5e7-497a-abd9-7121be575e0b", "value": "06F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407084, "uuid": "514e9f2b-5d3d-43c0-965f-4b8f5b38530f", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407084, "uuid": "19c9e9c3-8c78-4e92-a68e-dc553d98573f", "value": "3072:TBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHC/:FuXLcclWEc2HeSjNjGdei/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407084, "uuid": "eebd3c87-59bc-4900-8ae2-26a20fef6182", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407084, "uuid": "3a2b2ab3-76ed-4921-bb5a-908b94ef548b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407084, "uuid": "cf9482d1-58f9-4861-a83d-31a78a2ea13e", "value": "cfa7eecb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27eff2a3-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404007, "uuid": "0210863c-0f24-4f46-8ffe-130c65b60471", "comment": "Malware payload (Dridex)", "value": "969b4a05dd8764a65eef8e7d53976e61", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404007, "uuid": "ff65a2ef-32ba-4bc9-8627-906e97f08379", "comment": "Malware payload (Dridex)", "value": "90c2239f8df7f2af814c456ed088d5a447aa289e8be415550b0903c63a53d3dc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404007, "uuid": "04864dd8-4ae4-4043-8d8e-f38f877109da", "comment": "Malware payload (Dridex)", "value": "98d5ccbf717ee37cf7e299951c226ae7caa56c5b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404007, "uuid": "2873b0c9-f6ff-4f08-8beb-7fdc539e9261", "comment": "Malware payload (Dridex)", "value": "b04e8972e69b98acc81e005894db364ede885fe92f45b62c34b202a599b60fdf625929fefe72e2c6a6a092e855e6da6a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404007, "uuid": "ca1493f5-888a-463e-aba6-8a5bc6d486bb", "value": "22F3D141C9C5CCE0CBF36C3A4795963B3628B941995A8E42EC24CE2F615F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404007, "uuid": "90cb9723-de5a-4785-8cb0-96841d2e9232", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404007, "uuid": "80631fa8-06cc-4a32-babf-d0195fddb759", "value": "3072:1uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+zG:10czbty9uiaJlyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404007, "uuid": "72233204-bf4d-4076-90c6-ed2266db0d76", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404007, "uuid": "b3698156-c0e2-4db7-9896-c4544775ed4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404007, "uuid": "462c114e-8029-459b-bc11-18fd6c4c1ab7", "value": "969b4a05_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6b0197-af47-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620400555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400555, "uuid": "7c587463-0ded-44eb-a9c7-0f1e3c8b7f7c", "comment": "Malware payload", "value": "58142ad671ba175d743c7a9703b931d1", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400555, "uuid": "bb8b3edf-e33e-40ca-9eb9-d6855dd6d17d", "comment": "Malware payload", "value": "91665f6652b964a88e17e56ecb67d572cc4333ade81d0f1095dfcdd26abac287", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400555, "uuid": "d1dca0cf-e93d-4be7-8705-a957083b9063", "comment": "Malware payload", "value": "85f3b78e68bc9e81380134c152ff87555b28e417", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400555, "uuid": "e26b0966-d320-4a80-aaa7-7feb8ea8e2c1", "comment": "Malware payload", "value": "08d2edc55d53ed1330b2ca083971467bc0bd350bfab94b8ea86beffec7c4193921dafc7f7ecc1ca79ba86204b4391152", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400555, "uuid": "d3e13e16-bea4-4809-9420-844fb1384a6b", "value": "6483F159E43AFC71CCBA0735C2A90F1B690B25FADAC07614A750B09F1B84D858ADF993", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400555, "uuid": "3e3e3178-0809-405f-ab8c-4484097d63c8", "value": "1536:7IbWF4+8kAcrUHZvG/hiFdnxlEZL4C+PvC8PCz5IuR2ZH7DuVrBJb5KxcB:Mp+pA0/hifnwz8Ez5IuK7DuVQxcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620400555, "uuid": "fabaafb0-3943-45f5-9713-8107b7d5dd81", "value": 87980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620400555, "uuid": "dd7136a8-3e48-4d64-ad76-02d95f697aa8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400555, "uuid": "e6ba0804-9b18-40d2-bd79-a2bd3cbec691", "value": "fax 3212781.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc7a81c-af3e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620396718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396718, "uuid": "aeb36772-c168-4a08-8db8-ebf4484fd662", "comment": "Malware payload", "value": "e07d22a81b42a820c5a15c440d71a1dd", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396718, "uuid": "9c3e85c9-f9ad-400f-ba1c-ffa37d947abe", "comment": "Malware payload", "value": "917d71c2e140604ae2f4ebb41b76ac58dfe851604bf6d6cccf3f4e26cc2c9969", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396718, "uuid": "2bde4567-5efa-4006-bf45-aa9fabd9633b", "comment": "Malware payload", "value": "ac8d2294adac73834370d1f37a45d72b5f5401db", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620396718, "uuid": "3842c5f5-0539-4e77-90ac-bdf3cd399b0e", "comment": "Malware payload", "value": "b0249a19a8b93fff4df8067bf69044f707fa79499adaaebb1a365bae7797cef12bd872fd5eaf0027745a4b2d8a8a03bc", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396718, "uuid": "47ad4b9d-e536-4d3f-a50b-38d8f3df9897", "value": "EC04138E94E23ADFD5FF1AE7616036095B4AE1E2C0FC90AD47885C6E0930F7B63056E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396718, "uuid": "0e41c370-d90e-43e5-bcd0-1556d3188027", "value": "3072:IL8Qkrt7wCi4TaRck9uMTXF5dE2MJqd1FOYsTrFSpQ/kNOapPHGjXsuPlJyWRa0i:IL8BhwX2k9zTXFZMJoFyUSYOoHGjXsuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620396718, "uuid": "8bee0124-09cd-4587-8209-08b226656dcb", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620396718, "uuid": "2c3d388a-fe8a-4625-9a15-8bee73115f1d", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620396718, "uuid": "ac9028be-3fc8-4290-966a-25e6ab51e1f2", "value": "917d71c2e140604ae2f4ebb41b76ac58dfe851604bf6d6cccf3f4e26cc2c9969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f599cb1f-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403493, "uuid": "62f2e69d-7945-443d-93ab-642569ed1fac", "comment": "Malware payload (Dridex)", "value": "c35026eb504444a30681eca2fcf89b52", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403493, "uuid": "a69c5e2a-83a2-4b88-8f72-ba17ad7819e9", "comment": "Malware payload (Dridex)", "value": "91ba9cb1fa45d62e47fc1d22f6753ea16035fc7f2d0bb8799ae46f8d58660179", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403493, "uuid": "caae4b4b-56f5-481e-8bee-53ad7eb875c7", "comment": "Malware payload (Dridex)", "value": "9430736f34b59978b6916d83bebab58583ec5b5a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403493, "uuid": "67be6fcd-2bd3-493a-8230-077e807af9fc", "comment": "Malware payload (Dridex)", "value": "ffa7c04479f5abed9ab4960f79a49fc0b41efb03ebfe6ef1bb5212c7a0ff9b70dd58eb04d4eb05159f612a83c8b19402", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403493, "uuid": "6aaaced4-8e89-4cac-958f-4eb8ca71fec9", "value": "ADF3D080E78ED5E0FC075B333E680EEF52310087691954E4EF29DABDD6BB7E15164614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403493, "uuid": "003c5fb1-aaae-463c-8a55-f5133bea6edf", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403493, "uuid": "c5798846-ed7a-4bbb-95d0-31a7c8067509", "value": "3072:SBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHj8:yuXLcclWEc2HeSjNjGdeD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403493, "uuid": "76fabc74-ec44-4959-ad60-828feb2b0eb5", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403493, "uuid": "a2f264a6-b8c7-49a6-89fe-0a6d0348feab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403493, "uuid": "b0fef526-576a-42dd-9ac3-308d6b699ed1", "value": "c35026eb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3d926f-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403636, "uuid": "84a8a6b3-f167-45ef-96ae-98fc9ca33107", "comment": "Malware payload (Dridex)", "value": "cdd2e22b9da5f363d0a4af5fe9868c0d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403636, "uuid": "bb270a9a-7ea9-4b0f-9255-fd7b40a108ec", "comment": "Malware payload (Dridex)", "value": "91fd582677cd371694ef06c50c9135340315df8ae2366846988993d7341fa620", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403636, "uuid": "0a4a19f8-a7f6-4afe-89d6-beb5822f06f1", "comment": "Malware payload (Dridex)", "value": "fb59e5940f851a16546027e6226bd2155f105534", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403636, "uuid": "ee9cd001-866d-416d-b8d9-825732f1ac06", "comment": "Malware payload (Dridex)", "value": "06b46bd431c63549f99840905fe4da5ef9f82c3dcf86b93a74a972260222e38609583cc23bd07c28af0bf336bdcdf41a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403636, "uuid": "8ac725ed-0ea2-4fc4-85b1-9f4aac0cc4a0", "value": "0BF3D081E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E051A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403636, "uuid": "7478830d-6942-410b-862d-01f680c92ecb", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403636, "uuid": "771d5517-d6fa-4980-a4d6-8d4abb5736ba", "value": "3072:1BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHji:7uXLcclWEc2HeSjNjGdeDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403636, "uuid": "2bb07840-1f82-42b4-b668-39e8811b6572", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403636, "uuid": "08b30c23-0a11-413f-92b4-606e5ffb65f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403636, "uuid": "afddc34d-8f8e-47b2-a592-de0e13a16565", "value": "cdd2e22b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d7485b-aec7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620345691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345691, "uuid": "f17dc620-3e13-43d9-a0fb-cb756ee0b4bd", "comment": "Malware payload (Dridex)", "value": "384faf34dd21de3631fdd377457567a2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345691, "uuid": "c48de46b-1bdb-468a-b1b4-55960db8bb42", "comment": "Malware payload (Dridex)", "value": "9217f430b701f1d47844aaa5e979035e245be4353a7ac1f8060964b03685a49f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345691, "uuid": "d0cecced-bf28-451c-a834-cccb0a80b481", "comment": "Malware payload (Dridex)", "value": "59770749f6c7efcaa1a1f370528905f8f6a76e24", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620345691, "uuid": "61fcd024-3a2f-4562-bc92-5c463d7f6ab2", "comment": "Malware payload (Dridex)", "value": "894786754bc78bf22c7599fe1820e91e4fc719ab62b98626cc284544094e5535163d7d3c4d94db9259b363c9d46d19e5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345691, "uuid": "f5f4253f-9360-4bd0-bdc2-829038ee7f4d", "value": "8BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345691, "uuid": "214150c5-b185-4656-972d-b200e453a696", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345691, "uuid": "21e7a52c-5dd6-4b4e-96b0-42b18d2d98ae", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620345691, "uuid": "deedc41d-c8dc-4e54-af99-958e42c0d003", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620345691, "uuid": "8408364d-290d-45b9-b39c-0b2a936071ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620345691, "uuid": "c8f45cb1-9e98-44a0-94a5-f6ec59530b8d", "value": "384faf34_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b105ab59-aeef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620363005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363005, "uuid": "e69b4445-1a3b-49e0-9564-963c3478bb6c", "comment": "Malware payload", "value": "b3ce5b46d81426c9c83131a1d74c7c2c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363005, "uuid": "9331dcae-52a5-4e46-b481-e0852f83c565", "comment": "Malware payload", "value": "9221140e9f7e9baec64ff552c30c6bcda984435359863987ab93644f5c9fe344", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363005, "uuid": "7e80a030-788a-4256-acb9-7013e8e9a428", "comment": "Malware payload", "value": "834e2d3c2622a4a8a219ccb30bdfa3681af4e1fa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620363005, "uuid": "8136f72d-60a8-4eef-a83e-2d4ace48216a", "comment": "Malware payload", "value": "9aeb593e61342641bb6c7a348789590a6e069d22f53995df043697e6bd27f51392bd4eaf309106903df359874f472d74", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363005, "uuid": "d086b8fa-8637-4be3-9ed8-6f3f0b6a401c", "value": "8E4423531ED5D1A6CBF860782977B126A9A3A0D5908E304F8238D4BB547DB178C96C4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363005, "uuid": "abeb2869-74ca-4795-ab86-cadfcad02e11", "value": "c7cb4fceb036eda6dc2684d695c11c46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363005, "uuid": "b40e10a7-0ed2-4050-874e-1ff1c9ff6845", "value": "6144:88CRZ4yxz9rheAN+QifN3VW0OIR3t+AedVLkfVm:VNyd9nN+QWNFLR3t1UO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620363005, "uuid": "d5fd15c9-b6b3-46ba-aad0-f63f3bdffaa4", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620363005, "uuid": "6a6a0d65-530b-44db-b445-b64143ed9914", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620363005, "uuid": "389c4069-1b52-403a-8c05-5c23272e77da", "value": "b3ce5b46d81426c9c83131a1d74c7c2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a431c468-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620403786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403786, "uuid": "91024ac8-deba-4c1b-bdc5-3134f278d9c6", "comment": "Malware payload", "value": "534bc20a4b1f73994d1eec95045c036e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403786, "uuid": "81ea714a-38c2-4fd7-8b0f-34fee7a851db", "comment": "Malware payload", "value": "925063c18b58faafd0a78a070176a880b4f06f11ad5968b38fe8c250b121dc98", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403786, "uuid": "8b36d7a1-fd4a-41e3-a44e-fd5947e89f97", "comment": "Malware payload", "value": "9a02f81cf31c9b6291c3f9620b955c2683d8a572", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403786, "uuid": "e166e24d-62a2-469c-a61f-420f293453ca", "comment": "Malware payload", "value": "5863974d69ac92888809b770a8d2d9e1cce77670ad19e732e46d46c8f943ba628c8e3e33c85fd4748756b0a86b78ba5d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403786, "uuid": "e2e40bb7-3d52-4a8a-841c-0dd208e273d2", "value": "49D53387202CB076EBBDA9BC01764D5992C3341A25F1AD7002BF415E7ECB3974A9FB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403786, "uuid": "596668e9-26e9-48fc-8951-b8824b31eb02", "value": "49152:3Xq6Dxm7uSrFEWGqJT7SFO4G1SUG24EcoIsTrvVnH5t0+7yzoW/WkbIK7wUNTC4:3H9mHrMQT7SFs5G/EJIsnvGiyzoz0IEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403786, "uuid": "de55778a-5006-4d87-a84e-437e82c36dee", "value": 2837533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403786, "uuid": "0651b5b7-bb65-4f78-8485-400ba92a655d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403786, "uuid": "862b885d-5045-4eb3-a866-6ad5e91358b8", "value": "534bc20a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ef35af-af33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620392241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392241, "uuid": "0eb69615-f315-4f3d-8159-db8869e6dfdf", "comment": "Malware payload", "value": "8b493cce161c178ec9380baa0c16ffed", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392241, "uuid": "828c2a37-0ce4-47fe-808e-9739ba90b332", "comment": "Malware payload", "value": "926d1075cb3914cb99a19408433ebe956a3f82e7a489554f00be97cf5df44edc", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392241, "uuid": "0a46a3cf-de77-4a63-8277-ca8042f28aef", "comment": "Malware payload", "value": "8ca03d7ba733eb9f345af295a08a98af672ded07", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392241, "uuid": "cffc7db6-0adf-4f80-b3f6-cb6c54ec722c", "comment": "Malware payload", "value": "9c4b08ec7d524b5dab3244856dbb8e3ce7080598efd3630eceb6419bf869b3258cb0d840d9a1af5d8a15896dd522410a", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392241, "uuid": "2cfc9e61-903f-4ef5-834f-4439ca414777", "value": "F3A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392241, "uuid": "88f5ccdf-023b-4b3a-a1f9-8fb16ec6440a", "value": "96:NRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:NRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392241, "uuid": "435331dc-7eb2-414a-873d-99e535a3e329", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392241, "uuid": "a822269f-489f-4bc0-bb2a-bdea7dcc293b", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392241, "uuid": "f7bcd9cb-46c3-4363-ab46-b7bfd1110ca0", "value": "926d1075cb3914cb99a19408433ebe956a3f82e7a489554f00be97cf5df44edc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9398e76a-af35-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620393020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393020, "uuid": "5e58edff-97e4-4625-a2a4-b0283833907d", "comment": "Malware payload", "value": "36f3f07c5c861bc21b089f24a61216a0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393020, "uuid": "e39b7cde-5757-4145-a081-6a15b82ad48c", "comment": "Malware payload", "value": "929b4f389a650e4b4e5a20c7fdb49f376f195f0fb38edc71deaa1d9ee7fb2040", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393020, "uuid": "4c57999b-823a-4785-ac13-f8a99b0440c6", "comment": "Malware payload", "value": "febfadf1cfbeb3ba94a70e77c56aa5e257657838", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620393020, "uuid": "bc536d3e-b7de-49bd-854c-e5063ac0e0a2", "comment": "Malware payload", "value": "c6a963897f779cd9fdbe38aa87d975c9ee4730f4e5788383df8150ef56d8c710b2c7e1b77361f75a8392ec8253cc70c2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393020, "uuid": "e581cc0c-ac6c-4145-b3a5-7f24f10df74d", "value": "3E83820EAFA11EB7ECAFDC370ADA1745248E651661983F75BD30E918F24A24F15E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393020, "uuid": "583151e7-2eb3-4c07-af4b-62eede88f0bd", "value": "1536:UKph2wpJB9g4/o+5MI48AlscVfVZb+i1:bph2wpJBV/p4BfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620393020, "uuid": "01e70fd5-0048-4a0d-847d-fcf864c4efdb", "value": 88332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620393020, "uuid": "06e55c14-5f5a-4c3c-a8e5-c76ca19bc41c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620393020, "uuid": "ae7f22d9-f26f-4f41-9799-ed7b5f62f836", "value": "94VG.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2115b038-aefc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620368347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620368347, "uuid": "4aef0698-c8ba-4405-a3fa-2e07aa992783", "comment": "Malware payload (AgentTesla)", "value": "7eaef19cc024f1c43914647e109c00c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620368347, "uuid": "7655f65d-5d59-48ad-8784-5253a609fbdb", "comment": "Malware payload (AgentTesla)", "value": "9309d81abeb0a8e779dcd9e63f6ec4ac8dc106b86b723adb42a0004af47b3e0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620368347, "uuid": "58c21fcf-bf6c-4cf8-ab21-88352ef62551", "comment": "Malware payload (AgentTesla)", "value": "7e1a1ff19263d373fcb57548ca272b746251c5ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620368347, "uuid": "5bae4e9f-6028-48bb-b302-56046076d2f6", "comment": "Malware payload (AgentTesla)", "value": "b2c04dac34141e15b15336e7b8c1e4141026e6e81d971a5c1be19dff47be30ce0b690c61d2fff14b2ee7def3af5bb4d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620368347, "uuid": "15d9e44d-b247-4721-b385-515ecf60a606", "value": "CAF433789E066E0FB33F25FBFE94B6D8E3F2A7C006C3B59904D16E9589063436629416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620368347, "uuid": "4ad47cf6-522d-4768-96ff-b2c45da2c05c", "value": "12288:ARcP9kghxRNs8usRY8UNLawsGMOJygwMjurbdIX8cWbO5ltCjq5Pkw9jPPJYSwJj:AsRY88LaGMOkgbsQfKw9jPPJYJbvRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620368347, "uuid": "9e170ca3-02e0-4b42-8ec0-46ab31e06fff", "value": 772141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620368347, "uuid": "cd4d7cc8-9850-403b-9a1b-05acc4e032b4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620368347, "uuid": "e59a1009-b277-4ebe-b38b-2b8eea56d7cd", "value": "IMG_5018_330_92.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf42c65-aee0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620356474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356474, "uuid": "daa77816-85f1-46cf-87c1-ac558aa98148", "comment": "Malware payload (Dridex)", "value": "cec84a34140c14007162a6662a4e3fd0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356474, "uuid": "08f0d60c-cc78-4617-9569-a3bb349048f7", "comment": "Malware payload (Dridex)", "value": "93112bb3031138a045213e02866544d3302a13df72c9d56941ec3081fe9fe17a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356474, "uuid": "8fec0b71-6b9a-44b3-8e98-2f2946c8519a", "comment": "Malware payload (Dridex)", "value": "7ca5bed479283cb2799b67ca7675f958c5c54a58", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356474, "uuid": "943575e8-cf74-4bc3-94e4-6f1456012f16", "comment": "Malware payload (Dridex)", "value": "bf70c56b8a6651606f4a598f680b13cbbd08b1efbdcb9ab6e4eac867186b45d7caf420666dea2a067a092c7020fde274", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356474, "uuid": "71cef16d-5e0a-4e94-be62-039309a78395", "value": "F6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356474, "uuid": "d20b658c-0609-4c38-93ef-fa1e0ea23121", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356474, "uuid": "5b49f78b-65cc-447d-9a66-8accf03448b2", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620356474, "uuid": "f34fbd06-dd41-435f-a18f-50275022e3b4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620356474, "uuid": "d0de4e3e-96be-4b1a-a7aa-625fce78df00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356474, "uuid": "c18a18f3-0c37-44f5-9efe-9da303ac3ba3", "value": "cec84a34_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8291940-af39-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620394827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394827, "uuid": "5fc97c39-703b-41f6-a232-c7e848cfff41", "comment": "Malware payload (Mirai)", "value": "3be5c042f658ec168adcbb0f2cb59631", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394827, "uuid": "4bd87105-aaad-4e0e-8a63-b4c445d78620", "comment": "Malware payload (Mirai)", "value": "934c7dab35acf505f25e63d5753b57a4364df98ce270e7f08e2b6fce10ac738a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394827, "uuid": "6a1114c5-f77a-4026-99b5-10c272e87954", "comment": "Malware payload (Mirai)", "value": "d4964e91394ffb480e7340ce52c2772cbb42aa9e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620394827, "uuid": "cd2de774-2f56-4db5-a5c0-960378b7ab55", "comment": "Malware payload (Mirai)", "value": "a106d85eecefa0dc106a8bb138e7eda5cbcb38d69c72d67b4f148eed44e0ff4512f189002bb55a8b753d751356fd8987", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394827, "uuid": "61839c94-27e8-4b57-8803-e8c0680820ea", "value": "22836B2579797E63C1D4A07B16B34722F1E6230E38B8C72E7C701F0DEF146506A2A6B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394827, "uuid": "e024fb4b-ffd6-4257-984f-4a3304ce2ebb", "value": "1536:I4vZYSDSHCkEL1/S2DY3v80uwc6suGRf6x0:9v92n0KsY30VnRa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620394827, "uuid": "3d4a5229-6f3f-41f7-9727-f215c0f3bd95", "value": 88568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620394827, "uuid": "e13c3670-a9b9-4c8c-b04b-d2170f272951", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620394827, "uuid": "c6f8fceb-4548-4c5d-b91c-0d4b0ca75714", "value": "bo.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d4f4f8-af6f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620417700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417700, "uuid": "ccdb4e31-ffcc-4ecf-a70f-76cb424f1887", "comment": "Malware payload", "value": "1cedd77b2529b2a7a3720cd9de3f900b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417700, "uuid": "b3de8ffa-228f-4f4b-a786-803d7a53ae02", "comment": "Malware payload", "value": "93590c2624e111c3f254e4c8cba5dda48ff7baf7f5f0e15d460d282bed7910be", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417700, "uuid": "4647cdaf-d5ae-4e1f-8a55-610d688c28d1", "comment": "Malware payload", "value": "79a4770b79a4efcbc3c231e19232f4a230df76a4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417700, "uuid": "d6d4509c-34c9-44f0-b9a5-ee405e4e0cd1", "comment": "Malware payload", "value": "345f4286b4bd30f2605c7525b271ce28afaf02017f118bdec6b58e9739e5403039158d440533ee238812ba0629a5a774", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417700, "uuid": "aad34a86-4fdb-4a38-81c0-22b283528910", "value": "7EF3D081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417700, "uuid": "9f03170a-f741-44bb-8c7e-a48e8442e8c1", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417700, "uuid": "56119f8c-211b-47f0-97bb-83ed3cf3fe57", "value": "3072:qBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eH2H:auXLcclWEc2HeSjNjGdeWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620417700, "uuid": "df0d0ada-a967-4536-bc02-f8849a381d94", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620417700, "uuid": "a4d2af57-a56d-48d7-8b57-72401844ec78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417700, "uuid": "18b8b393-064e-4df8-80ac-d8040ad2944b", "value": "1cedd77b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da396d8b-aee8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620360068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360068, "uuid": "cb7404dd-b6f5-43fb-af65-cd24f12a4a32", "comment": "Malware payload (Dridex)", "value": "6a1aef4edc732739b4fd9a5c0f625f09", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360068, "uuid": "781fbe65-5ed6-4af5-a0a4-c30c52754e2d", "comment": "Malware payload (Dridex)", "value": "940f524e0799e29c8587f4d7ac17b700d19d416145f8d4b969e96e7d509a3af0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360068, "uuid": "a7a8516e-7e0f-4630-bc28-82f33a6d3a2f", "comment": "Malware payload (Dridex)", "value": "207edd563f676e816259404527bf73dc85310f32", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360068, "uuid": "a72462af-5503-4648-9b99-93ee039079c8", "comment": "Malware payload (Dridex)", "value": "d953e460770c280e30a6383a189693d66b331f04d53e0470ae600119add25ff8a0e8f364ea97427132fea5eee2559825", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360068, "uuid": "eff794d7-c472-449a-859f-9432158758a8", "value": "17F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360068, "uuid": "4841f854-0277-49d1-94be-00619cf46d1f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360068, "uuid": "f3c9f209-02bb-490e-b336-4e0fe6c6154c", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620360068, "uuid": "c7856092-3c44-434f-b118-faab4213145f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620360068, "uuid": "ba4ff99e-3ed6-41e7-8650-2ecb186ccb09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360068, "uuid": "eb2cbbf4-4b57-4a99-9356-9d8d9e7d91ed", "value": "6a1aef4e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674fa454-af46-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620400248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400248, "uuid": "9684a16c-daf9-430a-b895-9151f3407c79", "comment": "Malware payload", "value": "f1676ec6e04939b2fa2a65cbddb61a5d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400248, "uuid": "551edcf0-1ce6-4cfa-b08e-ce611712a17b", "comment": "Malware payload", "value": "942224cb4b458681cd9d9566795499929b3cedb7b4e6634c2b24cd1bf233b19a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400248, "uuid": "1a7aa06f-38b8-4a18-8147-0ae81a6ff2c7", "comment": "Malware payload", "value": "ee37a572276152eb06080028a0340443c09d7e81", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400248, "uuid": "f7f62be9-27ea-4c22-9991-d10ff184d675", "comment": "Malware payload", "value": "2945b2de34b171a1f2b54f830640d1e25dad8d547fafd2f3041bdabcda6aa80d8f75032889b256d27d73a0bd7016ec0b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400248, "uuid": "4162b18c-8ebc-42c5-97bf-095f94cb8d39", "value": "A0D2E5813EAD7427D372E928CA059F6A6829FD531C8323E667863F06CE7DCC406D6D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400248, "uuid": "ce91eed6-3985-4812-bd07-ebb1e194d1ba", "value": "192:jS6AlbMeE+5zd0f4x4yC8pTg1abfdAmUQkUSb0:tNeE+FdY4xFFgohAmUQkUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620400248, "uuid": "14323647-53af-4c6d-b0ba-13c20558efaa", "value": 30476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620400248, "uuid": "f8e067d5-051b-4a4c-851a-97c6467f2e91", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400248, "uuid": "8080e52d-333f-4cf8-af05-99bd99ac37dc", "value": "este documento un archivo en el cual se encuentra espec\u00edficamente el motivo por el cual se exige que compadezca al proc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49d36a9-aee8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620360085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360085, "uuid": "e1ac0547-1877-4fea-96d5-87697e357449", "comment": "Malware payload (Dridex)", "value": "8f2ea92bb3515c0164f934fc3eae13b4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360085, "uuid": "dcfa122f-9c55-4a9f-8eee-7e25cf9ab165", "comment": "Malware payload (Dridex)", "value": "9436b9fb9ad4e3113f87675dc207159b1cd12213087393452ea768ff6a4ac510", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360085, "uuid": "358f7372-2b05-48ea-aa34-49c1c556170d", "comment": "Malware payload (Dridex)", "value": "dc8e9467780d5ae315b61aeb5cf29707f10c003f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360085, "uuid": "219d0f56-6554-4635-8052-8a76d6226e02", "comment": "Malware payload (Dridex)", "value": "eb6019932f0a287c388d8fb935f8168c65b1eb9e4e71e3090cda07d28fceda45d7fef7375c27a49b1ff260f0171f63d6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360085, "uuid": "ede4fcbe-a34b-4111-af8b-186edbf11c22", "value": "C0F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360085, "uuid": "4e61cdfb-7ae7-426f-8315-8de6c9df7a7e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360085, "uuid": "7eafb0b1-af4b-4847-ab0e-c8284b3ca5fb", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620360085, "uuid": "a890b40c-931f-4432-8d88-d95edfc4772a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620360085, "uuid": "4dc399e7-2adf-4c83-aa3c-3f88ab68cafc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360085, "uuid": "710ff73e-c73a-469a-8c87-d524d3987fdc", "value": "8f2ea92b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320a1c56-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407460, "uuid": "f61d264d-9a63-43e1-ba5e-b9f69ae972c0", "comment": "Malware payload (Dridex)", "value": "1756b6278b40c9a1161ef09c4f0bc630", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407460, "uuid": "f424cdcf-396a-4de3-87a4-35908b183bbd", "comment": "Malware payload (Dridex)", "value": "945d3caa7e74ae856a2a821fcdf841855350a50f7637bf88592af9724be98ebf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407460, "uuid": "93ddb3c0-a7ba-4f22-a03e-91740070494b", "comment": "Malware payload (Dridex)", "value": "47f379e60e981d90a30235e37c60b78c7904f81b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407460, "uuid": "9271d5c5-1385-4972-a322-d25d9a939bcc", "comment": "Malware payload (Dridex)", "value": "b1e65d37e0edd633baf8c7d49a2bd72ed04d7b31d8c65a06f7f7154a3b3c25ff18844a783128317f34d1ee9c2052961b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407460, "uuid": "faa7ba37-fb3b-4c6c-89f2-438ef36888eb", "value": "3CF3D081E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABDD6BB7E051A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407460, "uuid": "ffc572c0-5733-4e62-812c-5d572ceee3ee", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407460, "uuid": "c09774d6-9b5f-44b3-8d23-a321e0cb2bab", "value": "3072:eBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHRX:muXLcclWEc2HeSjNjGdexX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407460, "uuid": "348d4e0a-ce02-4993-aa99-393482d10f65", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407460, "uuid": "fc7d27a3-7b2b-4b68-97bc-6bd3b16e23bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407460, "uuid": "85011f0b-7147-4dae-8310-2998a8383e27", "value": "1756b627_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167c7a14-aef3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1620364464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364464, "uuid": "5d7bf967-aa68-4fef-8e20-419d47b5e428", "comment": "Malware payload (AveMariaRAT)", "value": "620239d356bc0af1c8dd8846a2613424", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364464, "uuid": "6e5142cb-23df-40aa-9af9-0bb83662bc26", "comment": "Malware payload (AveMariaRAT)", "value": "9479384c915a5bf368753c99a365ac15a21652ee21bd5db5ccff32c6deb899f4", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364464, "uuid": "c6d43922-b885-4e07-8694-b8c6ebbdba60", "comment": "Malware payload (AveMariaRAT)", "value": "0d3d341acc603593c8e060220e5e5046f987c065", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620364464, "uuid": "89bfeb62-b7ff-4121-b4a9-70cfa89ba4b3", "comment": "Malware payload (AveMariaRAT)", "value": "7cc8875a639f93ced937e9ee44b4ef07c2ecf0463ff7bea8e860d7e7c9178347edc64f7157c6e0e4605373f331f13a54", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364464, "uuid": "d90b1de7-1a36-4529-83a9-333bd0fe4daa", "value": "8A74AE391A982623C47AD7BD25C0EC43F7929CD2715CEE4E1ACA9FC62562731E182D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364464, "uuid": "ff5fa868-c510-4539-823c-6a84dec807fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364464, "uuid": "b5b84b6e-7f4f-441e-9402-0b89b5868a5e", "value": "6144:8f8TgxuWvzqH/Psfmjuebb9jbRzmd7UOmm+F71XqIMCa:E8TgxkfPpTbbBRi+DBFsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620364464, "uuid": "4934ab97-ede5-448b-9ca4-cb7bdc6dde61", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620364464, "uuid": "9b436df2-c3d7-4c69-ac5a-479a9195d38d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620364464, "uuid": "27768553-dfba-4b41-aafa-a5e48777b937", "value": "dafa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399ae858-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403607, "uuid": "672f0a2e-289f-4710-a064-3f9c1fae2f9c", "comment": "Malware payload (Dridex)", "value": "58ce2d17715e4e7eb97758987d90d326", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403607, "uuid": "374faf38-ca7a-437b-b604-ec9bec4b759a", "comment": "Malware payload (Dridex)", "value": "9488b232732f06be6607bf1d2185833de7dffd446c2ab6df7fc6c39a1216b416", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403607, "uuid": "2da056a0-90f6-474d-8d71-6230b4a65db2", "comment": "Malware payload (Dridex)", "value": "142f022f77a0a61cef4c485616e7c13c2b6a3a96", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403607, "uuid": "7eeb0497-bb37-4dd7-af03-7067970208af", "comment": "Malware payload (Dridex)", "value": "724006b5b7b536029e8511806b24f66cdee3a7e057649c677c364fefe3f22e6eb564abe38ee7cf904a72dca128f5bb3c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403607, "uuid": "e72998c4-e75f-4e9b-8c54-309ccff8da95", "value": "11F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403607, "uuid": "cc436b2a-47f8-49b4-9e0e-a0441af46aaf", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403607, "uuid": "08d3c8ec-9d40-41b3-86a9-cfd20cd7e08c", "value": "3072:DBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHjS:VuXLcclWEc2HeSjNjGdeDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403607, "uuid": "0d18ef83-5d4b-4275-a537-69716a9db864", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403607, "uuid": "7164ef1f-9efb-48eb-9b91-ed55c24df18f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403607, "uuid": "a6ccec4c-fe33-4948-886c-8feedfd78cd4", "value": "58ce2d17_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae96ac6a-af4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620404233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404233, "uuid": "333ca484-6c61-4e5d-a7e0-eda87fc5d262", "comment": "Malware payload (Dridex)", "value": "d0300668af15ad74f16ace7d03e11f26", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404233, "uuid": "16c3f564-8d15-4ab6-a86c-ffba66468d8d", "comment": "Malware payload (Dridex)", "value": "94a8065c9e62305cda3f33bd5c0ab2d4674f8e178f1789b46c6c8b1bcf057837", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404233, "uuid": "ebabc62a-a4ca-4c0e-a1c8-852ff728df3f", "comment": "Malware payload (Dridex)", "value": "d7f5adf70fe45c58dd66d3bf478459b88f6e691c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404233, "uuid": "254ebe55-b046-4b50-8cd5-756cca33937a", "comment": "Malware payload (Dridex)", "value": "289504098deb90d0d4231ada9eac213c5a5cde8edc6618824245ab31a39cbff3b70e789fa09e0c6b6bbb0ec0c188c2db", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404233, "uuid": "6cc29c47-e56c-4d8c-a808-42c81149ac18", "value": "41F3E081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABDD6BB7E15164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404233, "uuid": "dfd4b798-5154-48b6-a41e-c006c3440ab2", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404233, "uuid": "5ff5be56-4641-46e7-a4b3-f4435ebb5027", "value": "3072:8BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHAh:IuXLcclWEc2HeSjNjGdegh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404233, "uuid": "754a0ea8-4d3e-4e28-831e-bb21892d601f", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404233, "uuid": "3e4fc40f-33b5-4a5b-81b8-874e3a489c1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404233, "uuid": "a0499fa5-ec95-4bbd-a108-ea8d7ecb1d73", "value": "d0300668_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5616ee-af6e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620417677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417677, "uuid": "d280b40c-548f-480b-aecf-3525106d02d8", "comment": "Malware payload", "value": "02601bcc58b82efa7ddddbb076a4cf4b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417677, "uuid": "338f2678-7024-473c-bfc7-8834191f1f8e", "comment": "Malware payload", "value": "94aed95c677eaa80ee0d6d3be9ec618fcda13b480ad9594ebcee850974ade77c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417677, "uuid": "9c114182-148e-4b2c-bc8c-bb1afaa7e503", "comment": "Malware payload", "value": "bb613e4578940dfa473bbe648a8962289367a152", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417677, "uuid": "cd6293ff-13e0-44eb-8033-c00a51d5f8de", "comment": "Malware payload", "value": "f2ed63795566755bfe907798d5435c9e78f73c07f59a4d5f0f3522c4ac4acdc70d3740c19d5e03f06adf3e8774e915ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417677, "uuid": "a464e6a3-3246-4888-b351-2231b1822b64", "value": "7CF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417677, "uuid": "5352d34a-6545-460a-be25-3687e9372c63", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417677, "uuid": "245e25aa-a6d3-4db2-9031-7830264353c1", "value": "3072:hiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:yeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620417677, "uuid": "f856d751-773a-46d3-bbd1-a067e8918388", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620417677, "uuid": "81af6bbf-e71b-4d3f-9f34-64f8f8ef9104", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417677, "uuid": "7b35dff7-e9e3-4f55-a585-acd7424cb1b4", "value": "02601bcc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d7b719-af0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620374479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374479, "uuid": "d6b00b6b-8bad-4a44-baff-838f4041ac0e", "comment": "Malware payload (Dridex)", "value": "a7058118538326521930a43cc442cffc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374479, "uuid": "804b7c28-a274-42c8-bb6b-24cb241decc3", "comment": "Malware payload (Dridex)", "value": "94ca7968af99f2ac7c5bac0cc9e62c18e78b697da359e7e41bc81ede9316b147", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374479, "uuid": "8a3d333d-f2a9-4631-a2a8-89b5d2eb80b7", "comment": "Malware payload (Dridex)", "value": "75f7c3df01d95126307ab98fde5f2e984846c354", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620374479, "uuid": "a5e60aa5-cded-4f73-a3b1-4ba967e88520", "comment": "Malware payload (Dridex)", "value": "840da3073d7dbc4accc6151b1e5c326830a965ea9af8b00afc0bfde4637cbf0ce0201c18926eac78099563edf5e1d226", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374479, "uuid": "bccb17a6-bf3c-4cc7-80b2-67e2c9716f33", "value": "9BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374479, "uuid": "46b38300-98dd-4a5b-90ce-038be9c4018c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374479, "uuid": "956c3815-0d7d-4a42-b039-e1eb48fe579f", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620374479, "uuid": "85b72e6a-27a8-46b0-b236-a221eb1c9d36", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620374479, "uuid": "d15efe02-4830-4636-ab2b-8250b7710d55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620374479, "uuid": "55e13402-98b8-4257-9205-54788fa65a19", "value": "a7058118_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45dd221c-aed8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620352947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352947, "uuid": "81e56a7f-5c81-4110-8ba5-392203c26220", "comment": "Malware payload (Dridex)", "value": "31a53f5e82ab82e6272de44a46f9345a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352947, "uuid": "0a022a2c-1786-4ed4-865b-3bd021147c9e", "comment": "Malware payload (Dridex)", "value": "9525db3dca3c84d7ac234feb4901a3e183d44f060c9253dc90a8537cb74c8854", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352947, "uuid": "56a02178-bd27-4c4f-8900-9644a8133520", "comment": "Malware payload (Dridex)", "value": "5bb785cdd69451460fabecaa0c683c5fca5b5d7d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620352947, "uuid": "e4ed0933-3a2d-4072-aeeb-6014b83692bf", "comment": "Malware payload (Dridex)", "value": "165864eef4c862b782ed7b95234adcd098ccb7d8986eeb85077d3491faa5d074ff8298d23de2860cc0a1797dc7d03911", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352947, "uuid": "fdd7090d-cab9-40e0-9b9b-6ce541dee43f", "value": "78F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352947, "uuid": "cd926108-ce14-4d99-9f24-c119fa276931", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352947, "uuid": "6d9567d9-b2d9-4477-b754-69fc07c8687b", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620352947, "uuid": "8c650b22-a60d-4199-affb-35afdb223db3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620352947, "uuid": "5df7b170-7f5c-44ed-956a-88b9e73e0940", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620352947, "uuid": "a01dbc7d-865e-48df-a741-3162c114d6cd", "value": "31a53f5e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816ca296-aeff-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620369797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369797, "uuid": "680e8480-a964-4199-b150-21627b2bfd83", "comment": "Malware payload (IcedID)", "value": "cdaaec40f8db8c05750db11175ca1e80", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369797, "uuid": "eecfc7c0-34a6-4c27-921b-fb39d872f6f5", "comment": "Malware payload (IcedID)", "value": "959172099b2c8d135e708d3abcf69a6316fd53916a30b8821bd1445251b21035", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369797, "uuid": "d1fddce5-035e-4534-bd75-dd724e61190d", "comment": "Malware payload (IcedID)", "value": "14df36d44dd8b8899e24faf8ef5d430c2baef00c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620369797, "uuid": "e9ca0055-9aaf-4c07-81ff-6c532fce05b0", "comment": "Malware payload (IcedID)", "value": "9e49803d51258f792bb976ca304caf1b06b93ab2dcae00f77ca4d5e2b38a90592dbbdd648416c3cc02c79e5bcf460608", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620369797, "uuid": "9e238e10-2c5e-46d7-ae3f-4239275d53b6", "value": "90B38C07CC098AC7C16D93FA6D075DF96E0E5719D8D62FEF40321F8A3A251631E4B1AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620369797, "uuid": "dc426be9-81ba-4276-b1e9-26ff54258aa9", "value": "3072:4WQvKINbjvw548LMb/oqKO8NnS8+60KcY5CCFTjy:48AbT648LM7D98Np+ET5rHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620369797, "uuid": "604a618a-2fcc-45b9-b9ee-a1300963164e", "value": 113004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620369797, "uuid": "86a56b7c-287e-4e60-80d7-9223228984c7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620369797, "uuid": "eb1238bb-8820-414a-af65-d11cbfa085ae", "value": "1456787477-05062021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a867f7ec-af41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620398209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620398209, "uuid": "344b403c-23cd-47a6-8d6b-ed7ff80a8a30", "comment": "Malware payload (Dridex)", "value": "77838fe56970ec040ea084f6c5b3def6", "object_relation": "md5", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620398209, "uuid": "4f11c8b2-27ac-4acc-811b-134f7cfa76eb", "comment": "Malware payload (Dridex)", "value": "95f36b06a9ef5bdf1301634ff67e49d51643e747c9be8ade616e26328c10ca02", "object_relation": "sha256", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620398209, "uuid": "e58baef8-50e6-4725-a509-aec41d6b015a", "comment": "Malware payload (Dridex)", "value": "99963315c98ca2de645e322f2fa6ee5e5775b949", "object_relation": "sha1", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620398209, "uuid": "13edb6b7-cdd7-455b-9955-bcccfb178a6e", "comment": "Malware payload (Dridex)", "value": "e4bd7ed1b6f97c5c9d7f9ff4d336aea601e8b582dcd35a33bfaf20ea3dbb12902905ff23ad2f98140a90a30c4b3f4ec1", "object_relation": "sha3-384", "Tag": [ { "name": "22203", "colour": "#5F54B6", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620398209, "uuid": "e1723590-f67d-495e-a692-1ba511c78fc8", "value": "1CC533B5BB428708E1091FF13EBE59914FF16A70F5AA404D7813F2FF4B6E45A62908B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620398209, "uuid": "fa1e1623-3591-4415-ae08-72a942cd190f", "value": "49152:TyQjailJOEDH0LYkaveM9w9WJ6ixqNvATNtBWJn1hKX+qqwElQfaAYaNY55ZcvVc:WFirCWepWJ6ixqmh2Fz7qqwIaxdN4ZGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620398209, "uuid": "2a308b7a-6a16-42bb-bd41-29e2a02d99a8", "value": 2740826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620398209, "uuid": "d1310d64-d76f-466b-a2a3-b18dfd630fe8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620398209, "uuid": "d763e5f5-419c-4157-a4e0-ccda149d5405", "value": "generated order 257404.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1810db7d-af4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403551, "uuid": "a9c5d70a-bc8a-4c72-81ef-11f5dc2a68bf", "comment": "Malware payload (Dridex)", "value": "d51cbcfda34121a99e93d7a124c6de26", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403551, "uuid": "0703bd8a-e79e-4b16-86fe-0cfb00c005ad", "comment": "Malware payload (Dridex)", "value": "95f53799b4ee02b092b1fc59a6e06780eb094cab5512be910b95b3ed722f5d6c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403551, "uuid": "9a1d4311-7766-4c25-95ef-683fa1d3f067", "comment": "Malware payload (Dridex)", "value": "be85f750aa10e204405ddbe58e399acbc105e9e1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403551, "uuid": "283f51c2-908e-410a-b331-5a8df2aa153e", "comment": "Malware payload (Dridex)", "value": "f0d13a5eb27f74f8e1f8a994ac4310b54a9aa59fe9db1743e1b6f7b39431bec2c78ffd682f4f3faba45b0b38f540e02d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403551, "uuid": "0dd6cd85-9980-4d0a-b866-6143888f9e79", "value": "CEF3D081E78ED5E0FC179B333EA80EEF52310087691854E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403551, "uuid": "f0310bb4-c62f-476f-a401-8562dc4f939c", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403551, "uuid": "d0fa2f7b-f0f8-4e22-ab21-785ecda1790d", "value": "3072:gBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHgR:UuXLcclWEc2HeSjNjGdeAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403551, "uuid": "379863d0-09d4-4ab6-a107-3dad45a7e4ba", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403551, "uuid": "b7e5c248-a086-41b2-8a1f-b8da49c91b21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403551, "uuid": "7f5c50b9-4839-41f7-82b1-63d99cfb877b", "value": "d51cbcfd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c40b03-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407328, "uuid": "5c442ccb-e8ca-46a9-90eb-008a43af3de6", "comment": "Malware payload (Dridex)", "value": "010a2f6f15d577079ad7ef8490b38c83", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407328, "uuid": "165e9afb-26d2-487b-a5b2-af39e72cb562", "comment": "Malware payload (Dridex)", "value": "9648aacd08aa09a3d6365f1ad656bfe3f1738bcd2d42bfa6945005c0dce9aad5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407328, "uuid": "3d694e9d-f073-4cfc-8721-8ab4ecf5b9b9", "comment": "Malware payload (Dridex)", "value": "5f351b9ecae5495240943111e82c1ca760396f0e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407328, "uuid": "5022672d-be95-49e0-af2f-8965237ac7c7", "comment": "Malware payload (Dridex)", "value": "7a9d0e03335e8df74882bc1c7bb0b9433e65bb54d499d645c72e4a3d37fb0da8589d2bd7f8d01092cf0a8c5c757a8bd0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407328, "uuid": "8c89b91b-c67a-4922-acde-70c9929c287a", "value": "11F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407328, "uuid": "ba7939c5-9bd5-4a61-aa72-9192df7b5c1b", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407328, "uuid": "4590a83c-e6af-4a17-8018-c367896694d6", "value": "3072:qBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:auXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407328, "uuid": "c19fc690-86a3-4bbd-9741-dafc3e46ad3f", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407328, "uuid": "7c22b09b-35ab-4cbc-8c3b-56e3c1061df4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407328, "uuid": "a0824d8c-ce4f-419e-90a2-95d0eec8f629", "value": "010a2f6f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261fbde0-af6f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620417748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417748, "uuid": "7bfd9266-6faf-4b12-8fe3-0d6db3152ae1", "comment": "Malware payload (Dridex)", "value": "147e92b7e460c21500d90edc3c9443cc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417748, "uuid": "5236be6f-679f-42bc-a63e-dc5fa0f6a227", "comment": "Malware payload (Dridex)", "value": "965450535a24fba382f0eb4922fd477a774d327d6b492443c36bc04eaf3ed99f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417748, "uuid": "54823ed1-0658-4738-afbe-3887da0cf732", "comment": "Malware payload (Dridex)", "value": "cc6cbd421ce5d4d6a66a906d7d1b7010656e242d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417748, "uuid": "c379ee76-32b8-4f4f-8859-b5e10138a762", "comment": "Malware payload (Dridex)", "value": "a61fee0d0bd996975e4cccbcc6118482d254c1e72d05a54ac51869785aabb79ce79da5c66d6e2b7fdae9bacfacd0dc46", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417748, "uuid": "7eef4f06-015c-4f25-81ba-bb3868e3c646", "value": "6AF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417748, "uuid": "306e1632-a982-4142-b861-ba9f705dd2a0", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417748, "uuid": "3f0ac0fb-ecc5-49ed-932a-595753bb655a", "value": "3072:SiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ReAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620417748, "uuid": "2e6c9f11-88cd-426e-ad52-779081025759", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620417748, "uuid": "fd9470ee-5e18-4dc3-952f-58effb25ad0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417748, "uuid": "69dd5b63-6d18-4eaa-a5b5-c9eba644bc5e", "value": "147e92b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86920e62-aee0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620356491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356491, "uuid": "5ed66dff-4289-48a4-a9c5-52727b568311", "comment": "Malware payload (Dridex)", "value": "604a51fe328b5ee20b49d76ce7b8639f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356491, "uuid": "31e50852-886a-4e0e-abff-af64c4721db4", "comment": "Malware payload (Dridex)", "value": "966c7f400a53e65c818d9c41363cb59fda2b0a1f2d22f8958436f6bdba6d1464", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356491, "uuid": "f1efe419-1053-4b76-826b-9fbacc681a73", "comment": "Malware payload (Dridex)", "value": "3c245a9f9803c30b75d1a4ce5809b884bec0e9a9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356491, "uuid": "645f824b-b863-4830-b4b6-8cd934825c53", "comment": "Malware payload (Dridex)", "value": "e78fc1c797923e5a27e8f4b7e790b854d12ee712e2afc2d27ab86d71898e5b2a1c9f49f86374729c83d1db78b9d88a8f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356491, "uuid": "e15df377-fe8f-4c90-9a27-1595b4f46245", "value": "4EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356491, "uuid": "2b46be1e-aae6-40c1-be7a-d2b5eab644bc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356491, "uuid": "9ba3fa92-d5fd-4a37-9e85-305c87a95bc9", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620356491, "uuid": "18b3c9ea-bebd-47c9-9e29-8c74a856059a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620356491, "uuid": "b2883063-d39e-4973-9ed3-4250b75d896d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356491, "uuid": "44fae511-d12b-4ed2-9c93-10cc8d3dfe5f", "value": "604a51fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4050c0c-af50-11eb-abe1-42010a9c0039", "comment": "Malware payload (Alien)", "timestamp": 1620404698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404698, "uuid": "223c8ff3-21f6-47a3-b7f3-3e16eb6be170", "comment": "Malware payload (Alien)", "value": "e763207653ee9506e09c10ef43090faa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404698, "uuid": "d4130e7a-5902-42c2-9f17-036373765f47", "comment": "Malware payload (Alien)", "value": "96ab53899db38080f89781aa6e0b3826fbdc4d650e781a4faba9b49a1f96b560", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404698, "uuid": "2b2f90ea-4b83-49e2-8c30-4c276c09f8f1", "comment": "Malware payload (Alien)", "value": "1856ebdd170ca8abc15cc38dc065190997f141eb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620404698, "uuid": "b722ab28-ae48-4d6e-9bba-a0e1098ce9d7", "comment": "Malware payload (Alien)", "value": "5f4970b20ee29fb01080788e5d6291ff66bf0669fa6a69f0e4e1ab90c4669efef5580972b026315a185d39fc899cfdce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404698, "uuid": "151ecd07-40df-440f-8978-0a72a73b0d14", "value": "71D533C7BA51D82AC86AAC32698B018677350F5A4474F76E01E534E939F3D204F1BEBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404698, "uuid": "a4062e6b-5fdd-465c-838b-bf3637310bda", "value": "49152:1ALCwSvjsyQtivnTX1p7uX7oLTzYVAIEBd0edm7Oum3eRqBcjnxO9x7lEGM2ur1B:1AWNjFp7GoDq7E0edmCD3eRX12RNteGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620404698, "uuid": "db1236ac-15db-4ba9-bcf1-e0f07bf7f2ad", "value": 2927747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620404698, "uuid": "776b8fdc-2fb5-4ce4-9aff-ecc706f909ec", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620404698, "uuid": "da507b48-0e16-485d-9089-c26792a294f3", "value": "DestekBasvuruFormu.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe8f4dc-af3f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620397121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397121, "uuid": "9c12aa6e-96b2-4277-ac43-ee6fe9a84a32", "comment": "Malware payload (Dridex)", "value": "3918e24b69047f3693b6c004f82d48ab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397121, "uuid": "0aea3810-ca8b-442d-8998-074c67912113", "comment": "Malware payload (Dridex)", "value": "97100f2e603bcbb9b0e874d65dbac7e5651d61537a43a5d6d1d4cedd70320852", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397121, "uuid": "7af5deb0-9ed8-492e-9bfd-ddafc0dd81b3", "comment": "Malware payload (Dridex)", "value": "f484f519015d4760219661be689b98336ad3ae29", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620397121, "uuid": "01cdb444-9fad-4cde-9c90-3c6f753d0be7", "comment": "Malware payload (Dridex)", "value": "855bc9536c79dc6b0a605d61c1d6cedb10b97755c273386916bfc1eb254ef7314d8e88f8131126217ea8f173d340fe13", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620397121, "uuid": "f128018b-8115-47e0-936a-29108703ef23", "value": "75F3C141C9C5CCF0CBE36C364795963B3628B941995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620397121, "uuid": "5b756d23-3791-42b1-9bbd-5bc225859df6", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620397121, "uuid": "a13605ca-6719-428a-bfe9-8eee5f4578d4", "value": "3072:WuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+yX:W0czbty9uiaJlnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620397121, "uuid": "25bb9fab-6bd0-4ffe-a790-ba378a13017b", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620397121, "uuid": "60e6cf14-be85-4a66-a826-084b05910372", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620397121, "uuid": "b87d5e1a-6704-49a4-a2cc-c34b3e646fe6", "value": "qxEJ4XFyEF.php.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3880c1f4-af04-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620371822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620371822, "uuid": "890494d7-b447-436d-9aab-2d0ea429f8eb", "comment": "Malware payload", "value": "3a4e1f3f7e1baab8b02f3a8ee20f98c9", "object_relation": "md5", "Tag": [ { "name": "Bouncer Loader", "colour": "#C6D593", "exportable": true, "hide_tag": false }, { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620371822, "uuid": "5fec2106-5e93-43a4-98d5-add0d4fc4751", "comment": "Malware payload", "value": "976e95586f1f9adbd5893daa82c7d890c3ebcd520de5e64aa6bf99cd7e8bfbf9", "object_relation": "sha256", "Tag": [ { "name": "Bouncer Loader", "colour": "#C6D593", "exportable": true, "hide_tag": false }, { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620371822, "uuid": "1a4ff8c3-a265-4d51-819c-d511a2c88fd9", "comment": "Malware payload", "value": "f2870b633f100392c913b5751f8e044205028e6e", "object_relation": "sha1", "Tag": [ { "name": "Bouncer Loader", "colour": "#C6D593", "exportable": true, "hide_tag": false }, { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620371822, "uuid": "a8f25461-45b1-48d3-9fce-390482d5e6b6", "comment": "Malware payload", "value": "627a562d8487d6609247ba4954edf94abfef43436843534549f9a0bea9e5c7039ede28fb63f80ab1504b87b50539c256", "object_relation": "sha3-384", "Tag": [ { "name": "Bouncer Loader", "colour": "#C6D593", "exportable": true, "hide_tag": false }, { "name": "Operation TunnelSnake", "colour": "#DF6703", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620371822, "uuid": "1dc4ae78-e329-4af3-ae2f-a7b273cd2fbe", "value": "2CC3E120BED0D033F4A714349824C7724EA9B8729ABC994777DC1ABD5FB22C457693B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620371822, "uuid": "5d000182-6a03-485b-a60c-3572f8c7115f", "value": "8c5c157b51a1d3e487fc19e227ccbb72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620371822, "uuid": "388f2be2-80ef-41a5-8a6a-85c0ce448cac", "value": "3072:0wpH/jfiIesjZZQctP3xLtQinp7FIfwDKUSn:NwI7FZQctfxLXn5afKSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620371822, "uuid": "6d229401-0708-4e64-97d6-51118e5d1692", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620371822, "uuid": "8fa1f2d8-aab4-4df1-90aa-5953c910ab66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620371822, "uuid": "8fdbf3bc-84de-4588-8a1f-8013345d6e7f", "value": "976e95586f1f9adbd5893daa82c7d890c3ebcd520de5e64aa6bf99cd7e8bfbf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbf04a0-af1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620381736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381736, "uuid": "89568d0a-cff2-4e08-a3bd-aa859b9a4e4f", "comment": "Malware payload (Dridex)", "value": "bf1e971acc4c790de8124b7b725ef891", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381736, "uuid": "c4153e82-563d-4d86-8435-c6f03b6d16c4", "comment": "Malware payload (Dridex)", "value": "97aaa218cda0f8ed611bb4a02a8e367401897aad0bb8cba748e8b25d52bf2b94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381736, "uuid": "3a5a47a6-029c-4f41-a28b-76bc58255d9c", "comment": "Malware payload (Dridex)", "value": "e034680b1370fb35c7d69eba68035e153f3cb314", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381736, "uuid": "49445a7e-f618-43d5-93fa-a84b1a96d23d", "comment": "Malware payload (Dridex)", "value": "f31d1924bf67addff9a3597cf8556feb3858f42410b4d4804d01146c61cd403521c8062f6b36d669bbc11ac2023bd4be", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381736, "uuid": "e110faf8-08af-4350-8aa0-93c1d01acea8", "value": "92F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381736, "uuid": "37bafcb1-8a99-4333-baec-97dc0f5901e5", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381736, "uuid": "d48ce673-f41d-47cb-a3ef-a1799c56b5d8", "value": "3072:lA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:l3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381736, "uuid": "12389a10-1260-46fa-9584-ff85b8dda1c2", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381736, "uuid": "07bbde73-2872-43bf-a068-c41f9b947e0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381736, "uuid": "33233bea-704f-4c18-a8be-d809bd623449", "value": "bf1e971a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4267d6-af6f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620417729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417729, "uuid": "2c70cb9b-27fd-41e5-a526-4a7475ce8cec", "comment": "Malware payload", "value": "35a32478f54a88594242bb97e3c7f3c0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417729, "uuid": "882feaca-16c1-4d98-a176-75a9156ab11a", "comment": "Malware payload", "value": "97afb02ae2daa0daff0038d98a5eabf4168d6c6b1d363304c1daee5b8ea364d1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417729, "uuid": "3d974263-7391-40cb-9a40-b9330c92569b", "comment": "Malware payload", "value": "70bee0cf1999113305c44417bd059cae61c26db6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417729, "uuid": "c59da74a-a2eb-40a7-837c-f588647ee063", "comment": "Malware payload", "value": "d9c7622cf96ffda01c06a7308e6a802d5304d29d9c43948ba43bafa2892c6312172b583e469055a1d2d28cd9d2d94282", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417729, "uuid": "3447c0df-dcf0-49a0-990f-96734b667854", "value": "B3F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417729, "uuid": "63b46963-c4b5-4a62-b512-c5f643e28620", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417729, "uuid": "3363f118-b564-44c3-9357-b01a2b411f39", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620417729, "uuid": "32067e19-024a-48e3-af7b-288ea6c84208", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620417729, "uuid": "18696bdb-8729-4607-82b5-7f19bb51010e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417729, "uuid": "d98b5395-716a-4aad-b8bb-3cd171cdd29b", "value": "35a32478_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c15192-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403359, "uuid": "9f4df22e-1355-47f8-8c3b-f3c3e71522c5", "comment": "Malware payload (Dridex)", "value": "1aa831ae6665643241d6c1f28e18cd0b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403359, "uuid": "b9f6e6d9-690b-45f1-abef-ec15f063474a", "comment": "Malware payload (Dridex)", "value": "97b1b78e0b720f38cc6ca92c9b85b6c520be6fcfaa57b193067f9f609d0075b6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403359, "uuid": "d5be445a-c8a5-4b68-9e6c-b1435fbb627e", "comment": "Malware payload (Dridex)", "value": "db6e638a9e3fca89ad9ce3f6b7bc20f070db2481", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403359, "uuid": "65f9aa7e-8d7c-4243-bb02-54a112b30f1c", "comment": "Malware payload (Dridex)", "value": "f1ce20c409c94b7a4a9dd1e91a5d44e7ceb926cf44e3d7c215e981d3eb859bcd8038a577103c7bd424301c890334078a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403359, "uuid": "73a5080e-56a0-4d65-829f-eb49aa09e11e", "value": "C1F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403359, "uuid": "d9042153-dd31-4bca-8b3e-b726f94b7a49", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403359, "uuid": "13236138-58fd-456d-bcd2-12b480344eed", "value": "3072:bBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:duXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403359, "uuid": "2913523f-9095-45af-b950-84be5701ce6a", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403359, "uuid": "602dbca1-324c-4f10-89c3-8e27c5ab3782", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403359, "uuid": "d52664e8-3263-4fa5-a9e6-b4f9fa6c5d7f", "value": "1aa831ae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59226ca-af2f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620390500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620390500, "uuid": "663a5141-0d70-4f03-a876-e92f6e0088f1", "comment": "Malware payload (AgentTesla)", "value": "46aa3b9c26e86a37645efa68d41bc47a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620390500, "uuid": "7c44d38e-9f94-4164-a84a-14bb0f8fef0a", "comment": "Malware payload (AgentTesla)", "value": "9842fa0c335043fd411cce338b46b32438f86b2ee76c454f29bd3355f729ee77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620390500, "uuid": "92b774e3-6453-4f63-8e58-c77a859f8199", "comment": "Malware payload (AgentTesla)", "value": "c6bf43150e1b62fe5e533649e13154ca5cc5563f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620390500, "uuid": "8d850bf5-9a34-495d-bb17-44db11ae3195", "comment": "Malware payload (AgentTesla)", "value": "7d2a268d6936b2fab64e03df97c8120ff44279f24c2627f760806687bd8c3f16f6d084ef90b1bda7e6608b2605653753", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620390500, "uuid": "8f2e527b-2d1e-4588-bf39-17cd6c4dfc42", "value": "6475E4AC321075EEC577CDA29BD91C24EA10207A572FD103972303FD9A9EE979F245E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620390500, "uuid": "bd2a176b-28ce-41e7-aea1-cb856f446253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620390500, "uuid": "ae2ebb0a-9978-49db-915a-0a73be155e4d", "value": "24576:wa19MAhYJ8qDcWipKK1oLAzW9V62reP+pM+eyzi7:wahYDqpKpTM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620390500, "uuid": "7d004f67-fead-4407-a0d2-d50dff950cf2", "value": 1558016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620390500, "uuid": "5908fc23-8aff-4dc3-92cc-676bec61453b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620390500, "uuid": "edb16935-dc8e-4427-9fef-ab74c339b4f7", "value": "angelx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8cd4f7-af12-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620378087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378087, "uuid": "d5a70824-c276-4275-82d2-bbafb9a8d250", "comment": "Malware payload (Dridex)", "value": "5e85d099ddbe9eaf86ade63bf85bc05f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378087, "uuid": "3696bb37-b252-43aa-bcdb-8848d9352e8a", "comment": "Malware payload (Dridex)", "value": "984c25d8e75f85d5a1362afcfe489ddf6e5354137e6efbb1f089e635fa6aeac5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378087, "uuid": "dbd40e49-93f4-4275-9862-679b602bd0bc", "comment": "Malware payload (Dridex)", "value": "4415f41864dec4fa6b15726d788d053b83230628", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378087, "uuid": "ea8b6eaf-6e36-4c47-b82e-c2c5c80d5db5", "comment": "Malware payload (Dridex)", "value": "00a95dd214b73295082e6ae274f52be603e64c1d38568c5c394e7e3436e2e0b23ec35bc8d60d5b50f3782e4a1804d0c3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378087, "uuid": "f82703de-818f-456d-8f62-39e322cf4c26", "value": "B9F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378087, "uuid": "931855d4-8afd-452e-b5be-2a42ce464292", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378087, "uuid": "41c58bae-7191-43e7-84f4-d3f353fae7d6", "value": "3072:5iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:qeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620378087, "uuid": "32c24aba-0a7e-40b2-8812-7260f6c0cbac", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620378087, "uuid": "776b2cb6-efe6-4c09-905b-e7b29fb05640", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378087, "uuid": "3e303540-d577-4f1e-88e0-9e876cd4037c", "value": "5e85d099_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47550cd0-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407066, "uuid": "5b8192d8-bcc8-4933-98bf-0b860e1ecaaf", "comment": "Malware payload (Dridex)", "value": "3a01a1a2b1e6fd5bc6d67ce554d9853d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407066, "uuid": "72e34efd-d4aa-4a47-876f-94d7accb6abe", "comment": "Malware payload (Dridex)", "value": "987f261c00bd3526e9801bbc7f1afe90ca3ea75a0f5a470875cdd19b58a37206", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407066, "uuid": "160ff251-16d4-4b9d-953a-c2b7b5f7b5ea", "comment": "Malware payload (Dridex)", "value": "a85d04575e57f3357bae684e95f3715753762797", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407066, "uuid": "fb131d03-1cd2-4c61-a940-0ec24b7d68c7", "comment": "Malware payload (Dridex)", "value": "a9e0ca7e018b2b57a0a08a487307279a83c79e208fde7ee05d1d7d7a05b81209c9d232cf173043e0b4291287dc6a520c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407066, "uuid": "b3828865-beb1-4c39-9885-3e3f18ae9ce8", "value": "D4F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407066, "uuid": "7b9fe36e-7bef-47e1-9138-310e93949a4b", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407066, "uuid": "2e91b950-8e3c-4bfb-a6af-b8f136b92225", "value": "3072:CBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:CuXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407066, "uuid": "91fda97c-938e-4699-97c0-0ead0683f3c8", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407066, "uuid": "942a354b-66b7-4d04-b3f6-ee4f61d06000", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407066, "uuid": "097c0a7b-aee1-4e27-b5c8-0b24d46d034c", "value": "3a01a1a2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e42076-af77-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620421270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421270, "uuid": "ee4f62ec-6255-432c-9c95-1361f9939ae5", "comment": "Malware payload (Dridex)", "value": "c1591d52f9c6de9b85853b987d1ec41b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421270, "uuid": "de3f2592-6303-4d3a-9a7f-465717ef75a1", "comment": "Malware payload (Dridex)", "value": "98cae1379bf2802359e0da417a94e7e80b1e5f9a10ebf60d802d516066749248", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421270, "uuid": "a202b1a3-5533-4f16-b896-b9ea6abeea90", "comment": "Malware payload (Dridex)", "value": "b71f500ddfacf9b1420b458dc94e5aa45791fed0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421270, "uuid": "f2b595ca-2abb-4b5e-8921-ee2ca29f03cf", "comment": "Malware payload (Dridex)", "value": "07411b80f1fa8f03235e0381c07599505b565c3e8f05952aabbd3a0b32c17615a60a8376698859a10539cf786f43c1ba", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421270, "uuid": "0438f126-511b-461e-9544-68923434b858", "value": "5BF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421270, "uuid": "8d816582-2f4d-46e3-a961-67efd8144328", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421270, "uuid": "31d5bcf4-bfa4-4fca-ae91-4057cc07b57b", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620421270, "uuid": "61f81ea5-b102-42e2-830d-1a651ff88f9a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620421270, "uuid": "da9763a3-2389-46fd-b375-92f2cb9ae0a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421270, "uuid": "77f06255-6fe8-4668-bef1-8dde69d37bea", "value": "c1591d52_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf9278a-af34-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620392472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392472, "uuid": "9fc8fe9e-8168-42fd-baa0-aada15a3e0e4", "comment": "Malware payload (RemcosRAT)", "value": "384e5af70000fb658251d79ddf8e8878", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392472, "uuid": "912b64e7-72d7-4dd0-8266-f8c583928fce", "comment": "Malware payload (RemcosRAT)", "value": "98e5d25243d03b80cc83c955796c42b39f308f55102a9ec01d0f308e06b4cfa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392472, "uuid": "dd9d3c45-4757-4c3b-bfdf-817f2c2ad52d", "comment": "Malware payload (RemcosRAT)", "value": "a2bafce0284f457eafd3dcbed73adeb84ed762df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620392472, "uuid": "6b9bd5ee-e658-44b8-b9a5-9bdd717d49d0", "comment": "Malware payload (RemcosRAT)", "value": "7446d4862241cdb648d6c9dee80e39797ebd86ad4c7e53530a9eb2c6ec1de0298bd267cc0eee51ad0c5f95c1dd1fda6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392472, "uuid": "9adcbd97-fe9b-42e9-8ebd-49e9201ea1d2", "value": "40657C07B7806792D1962A71C653D17442F28D3B9632F28F5CF43EE77A08B8B465F826", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392472, "uuid": "482d9553-bbad-4a8e-bd06-ba4d3a941a3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392472, "uuid": "d2f5c931-4a24-41fc-9fd0-3c68579f77ed", "value": "24576:dlo0SEzXF0oP0tKSRGhsC3Am7lB47mJ7AZbmDKt:dlo0SM0oPDhsJ8mmSRm2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620392472, "uuid": "71697684-3b83-4885-ad92-95844c6b5525", "value": 1474560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620392472, "uuid": "55b4f182-f6e3-46a3-a17c-08a7263a683d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620392472, "uuid": "96af88b6-1b58-442f-b293-bde920c85fbc", "value": "Statement of Account April-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81952915-aee0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620356483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356483, "uuid": "47575301-b258-4971-b26b-46c672b2b208", "comment": "Malware payload (Dridex)", "value": "9dabf7a4736f258dc3b7f3ee1f487bed", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356483, "uuid": "b98c583a-8a09-412a-ab37-b75f5711824e", "comment": "Malware payload (Dridex)", "value": "98f806e5b0569bf30eee9296741a6a4e92fff197fd3870bf908fae6e393a1ce7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356483, "uuid": "041a38ab-7906-4f5d-9577-0f2284448218", "comment": "Malware payload (Dridex)", "value": "776309298c4b959818984623b2612d2d63e80db9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620356483, "uuid": "afa33d72-9517-40da-9faa-ab59f9fa5ab1", "comment": "Malware payload (Dridex)", "value": "612628667de021395b53d3bc9e5909cc2e5d9cb1eb410e3912c2391d1faef1189cf26424b0b3fd3a18d2171ff8b142d0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356483, "uuid": "661d62c2-80ec-49dd-bd96-78e9d54b79e1", "value": "5AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356483, "uuid": "cca6de02-b576-4cc1-8f09-4d53f21344e1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356483, "uuid": "be9b7836-bc48-4844-92be-96da798e3b2a", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620356483, "uuid": "2961fe8c-0267-404d-9419-b76d275364f5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620356483, "uuid": "42d095d7-2384-4f3e-b7ca-8f33dd5c6239", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620356483, "uuid": "aaf3d06c-d509-44f7-99ff-273faaf33908", "value": "9dabf7a4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f091410-af23-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620385255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385255, "uuid": "68531d34-b65f-4634-97fc-aa5d37fd7161", "comment": "Malware payload", "value": "0a2a8aa3944b6f377ac18361e351ab26", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385255, "uuid": "65b7dcd8-eb56-4f19-9d26-2b62bbd8ba65", "comment": "Malware payload", "value": "9901fffc81769726c5217dfc2db580c1b67ad476f59451f9af8254c66966dafa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385255, "uuid": "ddd60e47-919a-4808-91f5-75f6a6ff58e9", "comment": "Malware payload", "value": "7d647c28efd45c8f0c38d30235308187e5f96d29", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620385255, "uuid": "9469d933-00b9-48d4-9ae3-7696ae831cf6", "comment": "Malware payload", "value": "972147f9cbfb113c4ddb70bc75e473b0a7637199fe55146d0db11cbe35d1c812a50c48b001ab792399066a45eacbdbfb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385255, "uuid": "91346765-597a-4b91-8a0b-35bb7cd1ab88", "value": "8112E0F4F59E8DD8480AEB981150A299776960F3FFF71C28BD2CE6C5CF59902689C842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385255, "uuid": "52848a22-aac0-4893-ac7e-6689bd1b888e", "value": "192:SUy/A9AXRcLzaFXgCDNUcq/dqdCwsPu+tW9Lu8rtwUuhTXrpQ4GpO0/5UeBrrOPU:S5A+BTFXgrcKsd2PuxLu0cTXtiXiurtD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620385255, "uuid": "5929a98c-28ee-4a3d-b642-95614a59c765", "value": 9753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620385255, "uuid": "b5646489-6d6e-4084-846c-9b7a9a134a45", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620385255, "uuid": "2f399b7b-91dd-4aa5-9194-600b2d363ff2", "value": "0a2a8aa3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b91b8b-af6f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620417739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417739, "uuid": "d938c075-4a15-4ae2-9d4e-57d27b2fe38a", "comment": "Malware payload (Dridex)", "value": "ff8fe05af1afb1f40e92b8f08ab09c78", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417739, "uuid": "e52c22be-4a1a-49ab-923e-69de446d38f2", "comment": "Malware payload (Dridex)", "value": "991f531a6e610d61ef322415873a8ecae5c5db698279696a26232d5109e4f83e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417739, "uuid": "36db506c-6b3c-42c7-adf3-036e3a8aea7e", "comment": "Malware payload (Dridex)", "value": "211e95795a324e279533561d5dcad267365c8d12", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620417739, "uuid": "58869900-1878-4231-bf13-45d08bc3ff8e", "comment": "Malware payload (Dridex)", "value": "b9c391d55e5d0364bf4f7ca38c76868cc9cedf5036ace7e8678ac21e47d6fc1e65579c55765cc0bd05a2ee76c09d1611", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417739, "uuid": "9ac78c30-7933-4efb-8432-b4bd0c261366", "value": "25F3D088CBB3E4E6EFB3937866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417739, "uuid": "c19b7bd4-9404-4be6-9e3c-026db8bd86bb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417739, "uuid": "64869497-6d96-40a1-b29a-6d348e9d022d", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620417739, "uuid": "db33a386-da5b-4729-86e2-d88276738525", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620417739, "uuid": "6cdb928d-07f2-4ab1-836a-52660b1d6e2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620417739, "uuid": "c0c4b0bf-1e0f-470c-b3eb-5d45dd832681", "value": "ff8fe05a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73498f97-af56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407140, "uuid": "3103414c-c406-4a1e-b4ef-a4e57621973c", "comment": "Malware payload (Dridex)", "value": "176546cbacad84ccc996e683d308e747", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407140, "uuid": "07d7305e-f992-44f1-8457-97f6e6362bf6", "comment": "Malware payload (Dridex)", "value": "992b4928b1b60cfaf547abcd95917e8ac664702f0abc3d307fcbb36eeb413e65", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407140, "uuid": "2aecfcd6-1a70-480e-8460-6d7b4be1029a", "comment": "Malware payload (Dridex)", "value": "f44f2e92035cd028dfdc7eeb0451fc8f3d7021cf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407140, "uuid": "14214453-619d-4626-8738-b6c67ca99ce9", "comment": "Malware payload (Dridex)", "value": "7f3f47e4ce29d8cd5fef0661aa8e7a51c6362a6cfe1db37b3a85e3afb115a9728887dabc797c65f495dcce8256631821", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407140, "uuid": "870e30be-5efb-4e48-b39c-4e51c833da65", "value": "27F3E081E78ED5E0FC079B333EA80EEF52310087691954E4EF29DABDD6BB7E05164A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407140, "uuid": "2c4f74ec-bbd9-4908-be62-1e71c04bb276", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407140, "uuid": "81b0164e-ff37-4e20-8d82-0854a38d2342", "value": "3072:SBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHCb:yuXLcclWEc2HeSjNjGdeib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407140, "uuid": "0eaea0ea-482a-485c-b990-777a90202e94", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407140, "uuid": "a79ce022-4291-4bc9-b10c-0c78ff6047ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407140, "uuid": "ee60139a-d5db-4f23-a80b-8d98b3cbab20", "value": "176546cb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26267796-af57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620407440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407440, "uuid": "419916a2-5dc6-411b-9eb5-67d8230868cd", "comment": "Malware payload (Dridex)", "value": "950037026a5811d3c21233218bd468c1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407440, "uuid": "0efa3549-e5c8-46ef-9e71-dd762f1e6dc8", "comment": "Malware payload (Dridex)", "value": "99fc574bbaaefce0b169b8ba5072ed8550a3d94569113ef7593893c073414668", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407440, "uuid": "d7120f31-2c42-43de-8d57-ad15ee0eb27b", "comment": "Malware payload (Dridex)", "value": "a46cb94f30279476a45b8f133130dea13c2952c4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620407440, "uuid": "56e1c29f-ed29-4aa5-8bb4-db7fca3e9da1", "comment": "Malware payload (Dridex)", "value": "c1ab1ba7fbfedb86e397f238cc4005485945c5a0871ab2efe30c1c78b34b8eac41f80bdf853b6eaed7cd1be65b71fe04", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407440, "uuid": "f694360c-2159-4bf6-b13d-a9eaed230b70", "value": "C2F3D081E78ED5E0FC079B333EA80EEF52310087691854E4EF29DABD95BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407440, "uuid": "0a584573-bdef-4495-8d9d-fbe5c7bb281f", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407440, "uuid": "b8d6b210-a2a7-40ce-adce-cc8c956a66d4", "value": "3072:XBoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHtZ:RuXLcclWEc2HeSjNjGdeNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620407440, "uuid": "33d19b3d-fb90-4d0c-b468-9b8c768a71de", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620407440, "uuid": "2cf71b78-2134-4b1b-bbf4-a61ae13cf194", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620407440, "uuid": "42d271ec-3fda-43cb-b843-b93009857585", "value": "95003702_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2335d89a-af86-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620427621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620427621, "uuid": "ed102561-1d74-4e27-9343-9789d580fab0", "comment": "Malware payload", "value": "d99b2a9c2c03c9b7947b3943c1f730ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620427621, "uuid": "aadec79e-778a-43a1-af5f-0e067a73b0ae", "comment": "Malware payload", "value": "99fedcd03a496046f7c1fd1312be6c47a4292c6c8fa3b41c6c0cc66fb40d32aa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620427621, "uuid": "1f14f762-e52b-4b8c-88ef-9e51b185a87e", "comment": "Malware payload", "value": "1f0aa55d8b1c05b91fa1d91b090cf42577056138", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620427621, "uuid": "faeefbb5-eabf-4f26-a271-184cca73bad6", "comment": "Malware payload", "value": "841dbc9aa40e917e2e283dff1957fed8d0a12f0618e7ef7b0d3914e559b848b3eb88e2a497e45b8a5129d3246ec97b57", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620427621, "uuid": "6e82d9b6-91c1-438d-988f-cc6aadbf0f4c", "value": "7BD53349C4D27B37C93B1374C9DA9BAAB51D58928CE3D53CFAA0D47CFA892D6010335A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620427621, "uuid": "5b36776c-6fb5-40b9-b84f-1668a6b1478e", "value": "49152:Thtvyzvp1Ec2VuROh87NnWG3fmaIBAZ67rq5Jy7zFsIaWimjDPn3fXx6:Tzv8v7ERVuRO27H3esZ+mzYh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620427621, "uuid": "1103e1fb-9fad-4fdd-9bcb-1111288a554c", "value": 3000718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620427621, "uuid": "19e7bc38-45a7-42a4-8959-ab97213119ff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620427621, "uuid": "3b4147a0-6539-4803-b40e-ff275805140a", "value": "SecuriteInfo.com.VB.Trojan.Valyria.4579.23869.23777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120d5721-af88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620428451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428451, "uuid": "7a5c6321-5966-4cd3-998c-928db89e3b79", "comment": "Malware payload", "value": "3ec29524c131b10448f2c0ef9ec90780", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428451, "uuid": "874e06ea-f77c-4370-a422-6503622fb206", "comment": "Malware payload", "value": "9a14ae8fd04889156fa113d955925b6497cd5b7af1c9c0df4d01fc745ae170a6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428451, "uuid": "71b1e87e-f7a3-4736-8dec-80369bdb458a", "comment": "Malware payload", "value": "1c24a06f1b40656244dc885c816ed8e13bf4edfe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620428451, "uuid": "c1e68233-689d-45a4-a8b7-c546c0027095", "comment": "Malware payload", "value": "076438d7d679b7f63184814ce0f183bc76e79099cd69b691fa5443a0224fb3c8fd6f9eccda478cbc2f2eb048c87054e3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428451, "uuid": "30661acd-f2da-46b1-a857-6e6809e9a25f", "value": "60F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428451, "uuid": "ec474498-5baa-4755-a503-cad25c48a444", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428451, "uuid": "dba3f530-e3c2-4a95-8b47-3ddd6e1d5679", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620428451, "uuid": "12de41c7-6cc5-456b-8c6b-45445decaaf9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620428451, "uuid": "4737480e-fa26-4397-9c5c-52d028d90adf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620428451, "uuid": "5c7bbdaf-f69e-4f4a-8289-6e7d272c9f49", "value": "3ec29524_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e414fa17-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403463, "uuid": "2237f8e7-6154-4581-b880-9b32c2191e93", "comment": "Malware payload (Dridex)", "value": "bc9ffa7a333fb94ae3860ce8ba8985f8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403463, "uuid": "421177c2-afd1-454c-a9a5-b8c7e427be20", "comment": "Malware payload (Dridex)", "value": "9ab6c56fee0017ff84963c16aa8943be5e87453138cbf40de00855f8d4d19ff3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403463, "uuid": "777ed228-0e97-418a-a3b3-7b2cb59b9cc7", "comment": "Malware payload (Dridex)", "value": "9fd6d4f071192f72aa2ec4cab9fc077b50683b87", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403463, "uuid": "d99447fd-ef8b-4ea7-8dc9-9cd4cae19d5d", "comment": "Malware payload (Dridex)", "value": "bb69f8e8e01dc05cf0ba9aaa6601eb775460e46bd1c0d07566cc8473326fd7ab1f457bd87ff5bf98c986235f74448f06", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403463, "uuid": "e97ff75b-16e9-415a-acb9-8b683977e52a", "value": "76F3D080E78ED5E0FC075B333EA80EEF52310087691954E4EF29DABD96BB7E151A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403463, "uuid": "35b51562-91cb-493a-b185-b222e32f6003", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403463, "uuid": "3f7ed8e2-162b-4fb8-bb15-3a2fd24aad66", "value": "3072:5BoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHuB:nuXLcclWEc2HeSjNjGdeOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403463, "uuid": "e69c7038-4703-4b37-abe8-6ea138c9245c", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403463, "uuid": "4306696a-4f46-4385-9c0f-c9f1909c4596", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403463, "uuid": "17f7a10c-db6a-4fae-8f2a-df9558de7f20", "value": "bc9ffa7a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ce529b-af4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620403382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403382, "uuid": "924bf06d-23fd-40b3-b2bf-56754bf21958", "comment": "Malware payload (Dridex)", "value": "1aac08de1f487752d101a6a7cd6da1f6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403382, "uuid": "2368ca2d-682d-45d5-9477-ca59d9e66f76", "comment": "Malware payload (Dridex)", "value": "9b27570247bef24de5664b3f92a18dd8a48fceb48b9c08e736fec49638161b7b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403382, "uuid": "62032910-783f-42a6-84c7-397a584d1c59", "comment": "Malware payload (Dridex)", "value": "8c7600d0005cb762a1db41bf9e3a45faa576f4aa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620403382, "uuid": "cd460219-553f-41d0-bf73-7254d179e054", "comment": "Malware payload (Dridex)", "value": "0c1857090b3afba24eeffa574e40de81000bd98ada164335c7f71b5e0a7d4b7599435698f4cc3a4305968e880c085425", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403382, "uuid": "a04c694a-35d8-4c91-997a-50e3a3943283", "value": "38F3D081E78ED5E0FC075B333EA80EEF52710087691854E4EF29DABD96BB7E051A4A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403382, "uuid": "f39d82a8-aa3f-46f5-9223-697dd6590074", "value": "e1b9538cb66d7213d7937a77000964f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403382, "uuid": "5c2b805b-d016-4a88-b3a4-fc30c1f58ab3", "value": "3072:ABoQctVOM7/8wZQvUlM7EF+V2xReSbHNjztUJQ8eHVR:0uXLcclWEc2HeSjNjGde1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620403382, "uuid": "fe6f2dee-6232-47b0-bf43-ff9432736de8", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620403382, "uuid": "e1d3412d-be44-4746-bb69-6fd18a295dea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620403382, "uuid": "033f3dd0-8009-4bbb-8152-81e40e4b5d5d", "value": "1aac08de_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe996c2b-af01-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620370866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370866, "uuid": "b14bd088-81d8-4885-8011-7d338e765e7c", "comment": "Malware payload (Dridex)", "value": "e6d331fcd111825da2a71fe93dd8e268", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370866, "uuid": "37d73e06-6f62-419c-b570-dc8f8ea49ca0", "comment": "Malware payload (Dridex)", "value": "9b35ee7b1ba2e39aca6425f87284a7d9bb4add1edee52f85c2e27b77d35e503f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370866, "uuid": "e1d6bdbd-9faa-40f2-8633-8f76eaf4aa3d", "comment": "Malware payload (Dridex)", "value": "fa3cf18b20fdbdac953b643a2227fbaf4559d220", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370866, "uuid": "83182bfd-e8ec-48b4-808c-992c05907083", "comment": "Malware payload (Dridex)", "value": "4a22b40c194578aae6e0989db30915ddcc2552a1f0a7f41765f2fba349dcab50ff439a6167049526d187b4a1eb1944f1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370866, "uuid": "58b2c39f-69ac-4c3f-82ec-6319b25f4c21", "value": "5AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370866, "uuid": "a63e37f7-2531-4330-aa3f-586fbbf5cf95", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370866, "uuid": "0bf85740-4bb0-4de6-98f0-a838ed899c54", "value": "3072:1lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:1lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620370866, "uuid": "151e0f9c-bbce-4233-bd93-445c2f31a5d6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620370866, "uuid": "37c3f56e-464d-49ac-a0d9-0a8b46c162cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370866, "uuid": "a42315b0-8655-41c0-a5a3-0795250a54df", "value": "e6d331fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3f9b07-af02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620370892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370892, "uuid": "895fe8c3-fa1f-4bed-92d6-1361f15179c4", "comment": "Malware payload (Dridex)", "value": "68853072f20a73e228691e34de055988", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370892, "uuid": "69b91aa8-45fc-40b4-a927-13e64d02aa78", "comment": "Malware payload (Dridex)", "value": "9b38a0ace8bb0bc003a97b9b47138c13e2b9575d1441fedd8401f2532ec73d17", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370892, "uuid": "ad8611e0-6ad6-4be5-944e-ad02d7bbc9ff", "comment": "Malware payload (Dridex)", "value": "8000bf2f6004c51823b99f0594eec2f5f6986817", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620370892, "uuid": "be18052b-86a9-46e6-a634-e48c9dd8c8ed", "comment": "Malware payload (Dridex)", "value": "71a431622360a2a19ecaf8512c4bf94ce78c92268b1b1302d7adec3f32dd7ded4c70f2926a9bb0563c67bd7946f4e62f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370892, "uuid": "d8956120-2c7c-4765-9adb-d1897331f894", "value": "A6F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370892, "uuid": "7663ee2b-02f5-477e-a935-e3b82c7e1ffe", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370892, "uuid": "70a8368f-d570-471a-9776-0312a26a5da1", "value": "3072:2WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:242IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620370892, "uuid": "78a65c7d-6273-41a8-a37e-54e877a0ebd5", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620370892, "uuid": "fa01bd87-0dbe-4243-97b4-1bc91820ad54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620370892, "uuid": "8152a2b6-16c7-4c99-b513-b0b41a53082c", "value": "68853072_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5286dbcb-af1b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620381744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381744, "uuid": "7b559054-92e9-43bd-8faf-6833afe2088b", "comment": "Malware payload", "value": "8c8495140b8c909b7c13e4e5896816db", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381744, "uuid": "07d93eba-54e2-4620-9e02-10e33c3d7173", "comment": "Malware payload", "value": "9b4a402320b637aeb3bbf37189726ba73347cc0ec33292f9ba42384b87407cb0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381744, "uuid": "dd45b168-8f55-4cad-8bb9-90aa873fc341", "comment": "Malware payload", "value": "e38749b995483d29e01e00dca716211ab85fe576", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620381744, "uuid": "2ebf0202-98e4-473f-9e82-0ba3aa7d917a", "comment": "Malware payload", "value": "a1f101ebdcd4a4fd370deff415e23bce4fa139d46216e5d526819aa4728fddb26fc631b4ccdeb3fbb07613d10828fb80", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381744, "uuid": "d7acc305-9f15-48cb-a311-c37b152f5426", "value": "B84502D1E300DABAF46721B0647D48467992AEEE81AA015FB35C7D396B7374300BEE47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381744, "uuid": "f0200f06-c734-4749-9c39-c769de748014", "value": "12288:90qE/q1ZA7iGuXU6CsHxENNHA7OlxgEderq:K/8ZAOvE0RaNkOnde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620381744, "uuid": "f15eb9a4-5182-4781-8515-e38147c1d70e", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620381744, "uuid": "83e79ddd-1067-49cd-9e78-4831df1d67d1", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620381744, "uuid": "753a15f8-c407-43af-a3b5-dba4ae276320", "value": "8c849514_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8269337e-af53-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620405877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620405877, "uuid": "640e47e3-57f6-4bed-820e-d709b05f7bfa", "comment": "Malware payload (AgentTesla)", "value": "596b83a169467280b5e047f498eeaa33", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620405877, "uuid": "1113aab8-be9a-4fb5-ba0d-fb4bf3f59b67", "comment": "Malware payload (AgentTesla)", "value": "9b5645b0f5e2fbbb8ec8c45c1a4e82922f73a7b6c28dbc6c5f397ad9bda83f77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620405877, "uuid": "15859716-6ce4-40f9-a231-3dcdc8a38ab0", "comment": "Malware payload (AgentTesla)", "value": "4d36aad5a72e14082ec57274921f503a9ae29aa1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620405877, "uuid": "6a784112-4669-47a6-96b6-e81ec55189c6", "comment": "Malware payload (AgentTesla)", "value": "5c31a05a5ba13d825b5fe8043817963ff266932e1e287bfbbb8d37a75778a0a1c8153047f88020a88aec98039db6bf87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620405877, "uuid": "2584feba-e8b9-48e0-92ad-c536b82d3774", "value": "BE03E0D3C3BF8111DB8E1B32A8442E6DBA16B4611D437E253B34CF1F12A9773297661A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620405877, "uuid": "aea91445-c274-46c8-ac0a-3b7ab23181d6", "value": "768:pG7cMx4dTVuspEbjrTiLV4fzJsf7/Ov8T/POQQXIGA9+OlQG/8:XVuXfY4fz0dHOcMyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620405877, "uuid": "2a94e3ae-80c3-43a2-a12e-c4354d7a99dd", "value": 38536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620405877, "uuid": "ea3c84a8-27ac-48f1-a137-a7915473aa2b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620405877, "uuid": "b13306ee-5cbc-4860-916c-c1307f89d1ff", "value": "IMG_6050_710_33.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66177e15-af46-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620400246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400246, "uuid": "a246f4b1-a749-4c4e-b955-0435bd517723", "comment": "Malware payload (AgentTesla)", "value": "3b00c2acb4f5cf9afaf9e66300c29092", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400246, "uuid": "a40c32cc-cf8f-4d75-9a57-462415a6a27e", "comment": "Malware payload (AgentTesla)", "value": "9b74576bc83aa22f65c9b435e033c44c34ce65eca5e06ebfeeec399d2f8244a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400246, "uuid": "6ed2c066-9bc7-440e-bf06-e1686767bb6f", "comment": "Malware payload (AgentTesla)", "value": "400b2692fc7855dd7e2e1d981df26d76093da2ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620400246, "uuid": "516dda0a-c612-4857-98bd-053b4808a047", "comment": "Malware payload (AgentTesla)", "value": "0b3ba50523b97d389bdd87a9cefb6b0b90f6a91d788a8c965c125bbda2f733f8ecad71abb0e4c62de65e68328feac267", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400246, "uuid": "435d071f-571c-4133-a024-5fc9a9f766b4", "value": "8FC401543384AF69E97E5BBE44B0960423F1F1019F93D31EAE94A4AD2D337C4CA69393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400246, "uuid": "eb337678-94a7-429a-9e4f-717562d1d904", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400246, "uuid": "c081b1a6-060a-42f6-9dee-67f54892819a", "value": "12288:yvMPm/dWDy4ioAuCy5mbEvthGU/P4I8hNUqHv7mQjllWh5U9kSM:DGay4ioAi84lfN8hNlHv7JZ4h+9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620400246, "uuid": "f325c416-8aee-4f59-82f5-bbb9169de398", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620400246, "uuid": "910a1e08-d0ae-4f87-b8b2-b7cba94f1a8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620400246, "uuid": "a3506741-a81b-4909-8b12-4e5e01c63bd0", "value": "Offer n. 123 - our ref.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6a0295-af77-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620421244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421244, "uuid": "9ddeb8da-3cfa-4d5f-b371-295b41d0f795", "comment": "Malware payload", "value": "b59bb7b5836f293315ba5f131aad0f5f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421244, "uuid": "889c2a40-0708-473e-a7bf-2c39e6871c27", "comment": "Malware payload", "value": "9b8c868d9cf97ba95acae0db795308030c4c040707a9342dd1a0248fd06b0ffe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421244, "uuid": "8a8acbdd-140d-43f8-9dca-c7d798cecd2d", "comment": "Malware payload", "value": "127ee962098e3feb05d2f3c465e9697f2f46959d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421244, "uuid": "dc9ea9fc-7301-44ca-b63e-d2f77d4b0d2f", "comment": "Malware payload", "value": "0bb261e9d1dff6545621fcf5f840cc13522905d16fe9990440effadf38b3549c359a27cf1522459a110feb2892cb19f4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421244, "uuid": "ebb7d7ab-d554-4144-b0ad-a89d5d42f999", "value": "BBF3C141C9C5CCF0CBE36C364695963B3328B541995A8E42EC24CE2FA15F3F1F95A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421244, "uuid": "d26f1118-6b35-48ed-85e5-f939551e89e5", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421244, "uuid": "4bf24d89-e09a-465f-9aa2-1352e04ae875", "value": "3072:4uFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+ii:40czbty9uiaJlbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620421244, "uuid": "2e5b906a-8b14-41c8-a45d-df04303222cd", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620421244, "uuid": "7ee56161-6561-4015-984c-8113d1b70591", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421244, "uuid": "da5e0324-4c96-47b5-8ea6-277147ec800c", "value": "b59bb7b5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf65ccbf-af11-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620377632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377632, "uuid": "c64135a8-d685-4868-a76a-03d1d7ef763d", "comment": "Malware payload (AgentTesla)", "value": "bfcfbed70c1d975695177c1c364d155f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377632, "uuid": "9e05cfff-e107-47aa-b999-d576571381c5", "comment": "Malware payload (AgentTesla)", "value": "9b92d72c9f1f2589b84b3b448a4f29a12d702b29e22e2fc5156cf6b43f738ea1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377632, "uuid": "f77d20cf-6206-4365-bfe5-7a5b7a9a71ba", "comment": "Malware payload (AgentTesla)", "value": "59a62fe5ba026f9ccb463075f20d55334a3015ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620377632, "uuid": "5d0bf9b7-5986-4347-ab7d-3c09a0e2af52", "comment": "Malware payload (AgentTesla)", "value": "2080430ef5f461ab297904ff6a8ca0325a4a4743cff0003541a46352a59151705216f5b4a6d478025cc3a67e08aded79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377632, "uuid": "faf5617b-add5-4f8d-8134-4db48df1dff7", "value": "2BB5C57D23A115A13BA3C14300CEC4307D9CE986D0B6FDADF9D2B1AD5826E80A7D756B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377632, "uuid": "ccd3ce1e-4583-4add-8e5d-e8111969c8ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377632, "uuid": "6870b393-de61-4288-b276-b8df16b5ca75", "value": "1536:f1vEgIartZYjdFKoYefqJUfs9yJ5PLOzhvCAuM2iLnVzkED+goX6VEgusaRe38xI:f1yzqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620377632, "uuid": "d86c6b72-9ee1-44bd-b8d0-5af35bcd77a6", "value": 2456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620377632, "uuid": "4fe96a4b-5027-4356-b8d2-666fa68e78d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620377632, "uuid": "0014e779-12f3-4870-a698-0342bfc8b4a0", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd323946-af12-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620378085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378085, "uuid": "8ad5b913-1a93-48f1-ad21-5148724eb114", "comment": "Malware payload (Dridex)", "value": "8338c24e2fa3f0497d32b36294f3b5dc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378085, "uuid": "42ece42a-225d-4046-b9b4-eec0565689c0", "comment": "Malware payload (Dridex)", "value": "9b975f8215c4f94ddb6fac908863f804fdd89751a5762b61004af9f239b99f9f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378085, "uuid": "9bcb3ba6-c562-486b-aeef-8033da373ada", "comment": "Malware payload (Dridex)", "value": "fb464182ce9b4405e5364421525283c7bc5e15dc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620378085, "uuid": "b8ec203f-d5de-4eb4-8d50-4e069cc85c4f", "comment": "Malware payload (Dridex)", "value": "5ec6d972fc5a9b065c882c1933135a679b7951e16fa4d767f4e23f31f42b2230e947801e6136e02d6f1e56f05cb8f74d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378085, "uuid": "7ceff5b6-1744-45bf-9f06-e8b2bf52cf25", "value": "B1F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378085, "uuid": "52b5e1bf-2df4-4b6b-935b-4d64f9c6d74e", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378085, "uuid": "10b2a52a-6151-4daa-a16e-4cb8f8c3e26c", "value": "3072:pWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:p42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620378085, "uuid": "5da34de1-30cf-42dc-aa7b-794078776952", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620378085, "uuid": "2f819b39-d08d-4f48-a374-8b677ee42b4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620378085, "uuid": "327f0cd1-8088-4c06-a2ec-58b94904790f", "value": "8338c24e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f175c5fc-aee8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620360107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360107, "uuid": "9336d8ce-1ed8-4312-aba4-97314d0c2d34", "comment": "Malware payload (Dridex)", "value": "1ec6d5443dd11a7cb498571a17f355fe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360107, "uuid": "7741f4ec-2dbf-4014-850e-0f3d89a31739", "comment": "Malware payload (Dridex)", "value": "9bbb47d870741d35d2c9961abfa8faebdd77b9f872afa8dc94ca7ff8554077d7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360107, "uuid": "5621c9fc-df19-4bdf-aaef-c14c7ccb3455", "comment": "Malware payload (Dridex)", "value": "f4d6377008286a7b610f98d560787e8fb75bb24c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620360107, "uuid": "fb8d222f-c3d8-47ef-b882-7a86c4ad5de9", "comment": "Malware payload (Dridex)", "value": "d8b6520d91b47af57a6645178c8bacc421816456736684279892d0a4085c46ec0b2c8551210ae147c3a141cedab383bc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360107, "uuid": "da6fb733-0a05-458a-95c4-c0dcb870fceb", "value": "19F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360107, "uuid": "cd45d5d1-5b19-454c-96d1-9145830951ab", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360107, "uuid": "230649d2-0e7b-47a0-a56a-ea3613d40e2a", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620360107, "uuid": "27a5fa90-83e9-459d-861d-4ea19dcfb3a9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620360107, "uuid": "57386844-a366-421d-8090-f1f103288a83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620360107, "uuid": "0dd08a1a-e092-4d0b-a60a-148c278b3feb", "value": "1ec6d544_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd21a3d6-af30-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620390943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620390943, "uuid": "cb7f8a31-e561-4acd-8644-099a23c8617d", "comment": "Malware payload (IcedID)", "value": "ebc29bb061f9aa3731321a5c59d8eae9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620390943, "uuid": "0bde85e7-e2ee-468f-b2bc-c5bde18f87c5", "comment": "Malware payload (IcedID)", "value": "9beb1b3b4e8b86c245f0088e5aaef7a123650668607ecdf48ffe7aeedfb2a592", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620390943, "uuid": "dab36090-70c5-40b9-994a-1b03c98f9b7b", "comment": "Malware payload (IcedID)", "value": "9351adf8d8ba4230093ef8e508c7790ecea7ff9a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620390943, "uuid": "9ac54f55-e13d-453b-8a85-0789f969475c", "comment": "Malware payload (IcedID)", "value": "4b6117667b481f75c7d22046ca2997e9d44e9a00939675b67655fea173e849d4439d2462d346746233910047328992b1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620390943, "uuid": "940255c9-16e4-4305-8ef8-ccfa3be77b71", "value": "F5346266C598D1BCF2476871357CAB58C550AE80AD12DDE3FAE6C412AF239B123213DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620390943, "uuid": "57da2245-6a42-4d7a-a7a8-2a4d3629a766", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620390943, "uuid": "69e08e84-ad0b-4425-a3a6-ec11e72b699a", "value": "6144:dJJLaU1mUGduNzGSijExi3oomlnG9PS9sfr8mnOySgEBmvpmCZdXWdyqL28888IS:dJJLaU1mUGduNzGSijExi3oomlnG9PSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620390943, "uuid": "506475de-89db-4667-ad49-83b48001b36a", "value": 244232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620390943, "uuid": "4623a71a-2f7a-4580-b475-ef61235a6a85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620390943, "uuid": "9a8a98ae-23fd-49b7-ada1-212a8d56139e", "value": "9beb1b3b4e8b86c245f0088e5aaef7a123650668607ec.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509775b3-af77-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620421255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421255, "uuid": "108b3c04-90ba-45b7-b245-5f10b503f7c9", "comment": "Malware payload", "value": "7909f4dc86110e73b4dd4d8fa1e1d642", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421255, "uuid": "ca320179-5114-4a34-a07e-eb561a33932e", "comment": "Malware payload", "value": "9c902f4d5b03bd4aa0a940ba6480161be96ecdc18a53fed9ab2bca3ca6402c8e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421255, "uuid": "3c020266-0f63-4e0d-b90e-9b616486ea24", "comment": "Malware payload", "value": "3a373e1be62bacb857e0f1a55c69f57f72965030", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620421255, "uuid": "ff9204f4-2c3e-4ce9-b9f3-4f7e7c958399", "comment": "Malware payload", "value": "645b28e517fcfd0645082ca8548f0e3587ab8982ce84fea19f91360b3e2a5bf6fbb7c45e87e42e21c6945cf074b46c12", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421255, "uuid": "c840e637-0364-423f-9c6a-51f12f2a7154", "value": "30F3C141C9C5CCF0CBE36C3A4695963B3728B541995A8E42EC24CE2FA15F3F1F85A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421255, "uuid": "9fd453ca-38e6-441a-9f99-b03534f69387", "value": "070ff6afd87a229a728220c23b97b8ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421255, "uuid": "88c70e73-1dbd-4d07-8603-40eac3df51b4", "value": "3072:AuFbQtsYQcjxanytIp92/l1iPPqs1/whG68DaHrnpDZ+qa:A0czbty9uiaJlva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620421255, "uuid": "10968702-3332-4969-b253-c823c3335602", "value": 170440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620421255, "uuid": "5eda0392-2742-44c8-bc51-127c585bf6e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620421255, "uuid": "ffebc77c-d526-474b-8f7e-528ce89d4b07", "value": "7909f4dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559d6914-af2b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1620388621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620388621, "uuid": "784a4be9-dd08-4bb9-b294-9e44d90445ae", "comment": "Malware payload (AveMariaRAT)", "value": "49e8a6ee9c5dd808767d4753639bb045", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha2